upstreamyard View on GitHub
An open-source project

Open-source infrastructure, packaged for Kubernetes.

upstreamyard packages ActiveMQ, Discourse, Fineract, NeMo Guardrails and 19 more projects as container images and Helm charts: built from official releases, signed, tested in Kubernetes and free to use.

Browse the catalog Read the documentation →
verify, then install
# every image is signed in public CI
$ cosign verify upstreamyard/discourse:latest \
    --certificate-identity-regexp '^https://github.com/upstreamyard/discourse/' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com
The cosign claims were validated

$ helm repo add upstreamyard https://upstreamyard.github.io/helm-charts
$ helm install forum upstreamyard/discourse -f values.yaml
$ helm test forum
Phase: Succeeded
  • 7 images · 23 Helm chartsopen source, Apache-2.0 packaging
  • Signed with SBOMcosign keyless, SLSA provenance
  • Rebuilt on every releaseupstream checked daily
  • Public CIevery build and test log on GitHub
Catalog

Free and open source.

Our own images for projects without a production-ready image, plus Helm charts for those and for projects whose official images are already good.

upstreamyard/activemq

Apache ActiveMQ Classic

Message broker for JMS, AMQP, STOMP and MQTT. 5.19 and 6.x lines, JDBC master/slave HA, Prometheus metrics.

 upstreamyard/aegra

Aegra

Self-hosted, open-source alternative to LangGraph Platform for running AI agents.

 upstreamyard/conductor

Conductor OSS

Workflow orchestration engine originally built at Netflix, with its UI in the same image.

 upstreamyard/discourse

Discourse

Community forum, split into one process per container so it runs naturally on Kubernetes.

 upstreamyard/fineract

Apache Fineract

Core banking API for loans, savings and accounting. PostgreSQL or MariaDB, TLS by default.

 upstreamyard/nemo-guardrails

NVIDIA NeMo Guardrails

OpenAI-compatible guardrails server for LLMs: jailbreak, content safety, PII and dialog rails.

 upstreamyard/shardingsphere-proxy

Apache ShardingSphere-Proxy

Database proxy for sharding, read/write splitting and encryption in front of MySQL and PostgreSQL.

Helm charts

uses our image  ·  others use the project's official image

ActiveMQ Aegra AutoMQ Conductor Cube Discourse Docling Serve Dolt Electric FalkorDB Fineract Kvrocks LocalAI Logto NeMo Guardrails Parse Server Plano Postal Saleor ShardingSphere-Proxy SuperTokens TigerBeetle XXL-JOB

Missing a project? Suggest it.

Security & quality

Every image meets the same standards.

One pipeline and one set of rules for every project. Nothing is published before it passes its tests, and you can check all of it yourself.

Signed, with SBOM and provenance

Keyless cosign signatures from GitHub Actions on every image and chart; an SBOM and SLSA provenance on every image.

Non-root by default

Every image runs as UID 10001; where the app allows it, with a read-only root filesystem.

Verified upstream sources

Built from release tags, or from official archives checked against SHA-512 sums and GPG signatures. Upstream code is never patched.

Smoke-tested before publishing

Each image starts against its real dependencies, such as PostgreSQL, Redis or MySQL, before it is pushed.

Charts installed for real

Every chart change is installed in a Kubernetes cluster in CI and must pass helm test.

Your data stays yours

Charts never bundle databases. You bring your own PostgreSQL, Redis or S3, managed the way you already manage them.

Don't take our word for it. Every Dockerfile, chart, build log and test run is public on GitHub.

Inspect the pipelines on GitHub →
FAQ

Common questions

Are the images and charts really free?

Yes. The Dockerfiles, scripts and Helm charts are open source under Apache-2.0, and the images are public on Docker Hub and GHCR. Each application keeps its own upstream license.

Are you affiliated with the upstream projects?

No. upstreamyard images and charts are community-maintained. We build from the projects' official releases and never patch their code; bugs we find are reported upstream.

How can I verify an image before I run it?

Every image is signed keylessly in GitHub Actions and carries an SBOM and SLSA provenance:

cosign verify upstreamyard/<image>:<tag> \
  --certificate-identity-regexp '^https://github.com/upstreamyard/<image>/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Can I suggest a project for the catalog?

Yes. Write to us with the project's name and a link to its releases. New images and charts go through the same process as the existing ones: built from official releases, signed and tested.

How quickly do new upstream releases reach the images?

Every image repository checks for new releases daily. A new release is built, smoke-tested, signed and published automatically, and the matching chart update is tested in Kubernetes before it is released.

Contact

Questions or feedback?

Have any questions, feedback, or need help (e.g. setup, hardened images, etc.)? Reach out at contact@upstreamyard.com

It helps if you include:

  • the project(s) and versions you're interested in
  • where they run (Kubernetes version, cloud or on-prem)
  • your question
Email contact@upstreamyard.com Reach out with questions

Opens your email app with a short template. We use your message only to reply. No cookies, no tracking: privacy policy.