Overview

SecOps Central is a free catalog of hardened machine images, in the spirit of the old Bitnami catalog: launch the image and the application works, with security already in place. When Bitnami’s free catalog ended in 2025, it left room for a free, maintained and hardened alternative, and that is what SecOps Central sets out to be.

The Catalog

Images are layered as base → runtime → application:

  • Base: a hardened operating-system foundation with first-boot configuration and a management command-line tool.
  • Runtimes: hardened web runtimes for running your own applications.
  • Applications: business and website applications, ready to use on first launch.

Each image’s sheet lists what it adds beyond a default installation, and which recent vulnerabilities it patches or mitigates.

Security & Hardening

  • Secure by default: images are hardened before they ship, and the web runtimes include a web application firewall. Nothing needs to be locked down after launch.
  • No inherited secrets: images ship without leftover keys, credentials or shell history, and generate unique credentials on first launch.
  • Tested before every release: every image passes automated boot, security and hygiene checks before it is published, and stable releases go through a soak period first.
  • Continuous patching: images are rebuilt regularly, and each release notes the vulnerabilities it patches or mitigates.
  • Least-privilege pipeline: the build pipeline uses short-lived credentials, and contract tests prove it can do only what it needs to.
  • Protected releases: only maintainers and the pipeline can create release tags, and official images come from a single published owner, so users can verify them.
  • Coordinated disclosure: a published security.txt tells researchers how to report vulnerabilities.

How It’s Built

  • Reproducible builds: every image is built from a recorded, version-controlled recipe.
  • Infrastructure as Code: build and test environments are code, reviewed like any other change.
  • Hexagonal architecture: the management tool keeps its domain logic free of I/O, so it is tested without touching the cloud.
  • Contract testing: tests run against the real boundaries (permissions, images, configuration) and not only against mocks.
  • Architecture Decision Records: every significant decision is written down and reviewed.