helmforge/kubectl repository overview

⁠helmforge/kubectl

Minimal, secure and multi-architecture kubectl container image for Kubernetes automation.

Designed for Kubernetes Jobs, CronJobs, CI/CD pipelines, GitOps workflows and operational scripts that need a clean and reliable kubectl runtime.

⁠Features

• Minimal Alpine-based image
• Multi-architecture support: linux/amd64 and linux/arm64
• Runs as non-root user by default
• Includes kubectl and kustomize
• Versioned tags for reproducible usage
• Signed with Cosign
• SBOM available in CycloneDX format
• kubectl binary verified with SHA256 during build

⁠Quick usage

docker run --rm docker.io/helmforge/kubectl:latest version --client

Using a local kubeconfig:

docker run --rm -v ~/.kube:/home/kubectl/.kube:ro docker.io/helmforge/kubectl:latest get pods -A

⁠Kubernetes Job example

apiVersion: batch/v1
kind: Job
metadata:
  name: kubectl-job
spec:
  template:
    spec:
      serviceAccountName: kubectl-sa
      containers:
        - name: kubectl
          image: docker.io/helmforge/kubectl:latest
          command: ["kubectl", "get", "pods", "-A"]
      restartPolicy: Never

⁠Tags

• latest — latest published kubectl image
• <version> — pinned kubectl version

For production workloads, prefer pinning a specific version instead of using latest.

docker pull docker.io/helmforge/kubectl:<version>

⁠Security

This image follows a security-first build approach:

• Non-root runtime user
• Minimal package set
• No embedded credentials
• Image signing
• SBOM generation
• Binary checksum validation

⁠Source

https://github.com/helmforgedev/kubectl⁠

⁠Maintained by HelmForge

Part of the HelmForge ecosystem: lightweight, transparent and production-ready tooling for Kubernetes operations.