readystack/miniflux repository overview

⁠Miniflux

readystack/miniflux:2.3.4-CE-ubuntu24.04-r3

Source, recipe and records

• Source and build recipe: https://readystack.dev/products/miniflux/recipe⁠
• Upstream source at this release's pinned commit (2.3.4): https://github.com/miniflux/v2/tree/238c5614e584ebc87894e7d9f10bc91373a0b2c2⁠
• Product page: https://readystack.dev/products/miniflux⁠
• Hermetic Build Kit for this release (free with an account): https://readystack.dev/products/miniflux⁠
• Release history (JSON): https://readystack.dev/api/releases/miniflux⁠
• Defect record: https://readystack.dev/defects.html?product=miniflux⁠
• Today's scan: https://readystack.dev/products/miniflux#pp-grade⁠
• Report an issue: https://github.com/ReadyStackFree/readystack/issues/new?template=bug.yml&product=miniflux⁠
• Signing key (cosign): https://readystack.dev/keys/cosign.pub⁠

A cosign-signed build of miniflux, built clean-room from official upstream source by ReadyStack⁠.

⁠Who uses it and why

Who: Individuals and small teams who follow news, blogs and podcasts through feeds and want a simple self-hosted reader.

Why: Miniflux is a minimalist, self-hosted feed reader designed for readability. It can fetch the full original article and removes pixel trackers and tracking parameters.

Use case: A developer follows many blogs, release notes and news sites. Miniflux checks every feed, shows unread articles in a clean layout that works from the keyboard, fetches the full text when a feed carries only a summary, and strips trackers along the way.

About the upstream project, written from its own description: https://github.com/miniflux/v2⁠ · https://miniflux.app/⁠

⁠What you get

Signature, user and attestations below were measured on the published digest sha256:9d95b4060c916f98b435376dbcd0049a700ffeea35a6b7c9cdcdc9d89d80e096 on 2026-10-28.

• Scan scores — we scan every image we publish every day (an SBOM made with syft, vulnerabilities matched with grype, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26) and record each scan with how its score was derived. This release's first and latest scan: https://readystack.dev/products/miniflux⁠
• ReadyStack release check — passed at release on 2026-10-27: no fixable critical or high vulnerability (Docker Scout and OSV), a non-root user, SBOM and provenance attached. This is ReadyStack's own test, not a Docker grade; vulnerabilities published since then are in today's result at https://readystack.dev/queue⁠.
• Signed — cosign signature by the ReadyStack release key (fingerprint 04daa92344a52dbc) on this release's index digest sha256:9d95b4060c916f98b435376dbcd0049a700ffeea35a6b7c9cdcdc9d89d80e096; verify with cosign verify --key https://readystack.dev/keys/cosign.pub readystack/miniflux:2.3.4-CE-ubuntu24.04-r3.
• Attestations — An SPDX SBOM and SLSA v1 build provenance are attached to this digest.
• Runs as a non-root user (miniflux).
• Built from source by ReadyStack.

⁠Which tag should I pull?

This image follows the ReadyStack release-tag convention:

• The current release is 2.3.4-CE-ubuntu24.04-r3 — the release listed at readystack.dev. Release tags use the pattern <upstream-version>-CE-<base-os>-r<N>; the current one is signed, attested (SBOM + provenance), and is provided under the ReadyStack Agreement⁠.

• Earlier release tags (an older version or revision in the same pattern) are superseded. They stay pullable so existing deployments can pin them, but they are no longer re-graded, and fixes appear only in newer releases: move to the current release. For a superseded release's build kit, ask support.

• Release tags never move, so pulling the same tag again never changes the image. To be offered each new release automatically (a new revision r<N+1>, or a new upstream version), use the ReadyStack Renovate preset: https://readystack.dev/updates.html⁠

• Any tag beginning with internal- is an engineering-pipeline artifact published for build observability. It is unsupported, may change or disappear without notice, and must not be used in production.

# ✓ current release
docker pull readystack/miniflux:2.3.4-CE-ubuntu24.04-r3

# ✗ unsupported (do not pull)
docker pull readystack/miniflux:internal-...

This release is signed; verify it with cosign verify --key https://readystack.dev/keys/cosign.pub readystack/miniflux:2.3.4-CE-ubuntu24.04-r3 (the signature is recorded in the public Sigstore transparency log). Support: [email protected]⁠, as set out in the ReadyStack Agreement⁠.

⁠Deployment

See the ReadyStack Hermetic Build Kit for full docs.

Secrets go in an env file that only you can read, not on the command line, and passwords that only set up the first start come out of it after setup. Create miniflux.env with install -m 600 /dev/null miniflux.env, then write these lines into it with an editor, with your own values (a value typed into a shell stays in its history). Docker reads each line as written: no quotes around a value, no spaces around =.

# The PostgreSQL connection, password included; needed at every start. It is a URL: percent-encode every character of the password that is not a letter or digit (space %20, @ %40, / %2F, $ %24, ! %21). ADMIN_PASSWORD is not a URL and is written as it is.
DATABASE_URL=postgres://miniflux:YOUR_DB_PW@YOUR_DB_HOST:5432/miniflux?sslmode=disable
# First start only: these three lines create the administrator. Remove CREATE_ADMIN, ADMIN_USERNAME and ADMIN_PASSWORD together after setup and recreate the container; the administrator keeps the password.
CREATE_ADMIN=1
ADMIN_USERNAME=admin
ADMIN_PASSWORD=YOUR_ADMIN_PASSWORD

docker run -d --name miniflux -p 8080:8080 --env-file ./miniflux.env readystack/miniflux:2.3.4-CE-ubuntu24.04-r3

Once the first start has created the administrator, remove the CREATE_ADMIN, ADMIN_USERNAME and ADMIN_PASSWORD lines from miniflux.env together and recreate the container (docker rm -f miniflux, then the docker run command again): Miniflux reads them at every start, but an existing administrator keeps its password, and the password is no longer in the container's environment (tested). Removing ADMIN_PASSWORD alone while CREATE_ADMIN=1 stays leaves a half-set configuration (the container still starts while ADMIN_USERNAME is an existing administrator, but exits on an empty database or a different ADMIN_USERNAME).

⁠The full ReadyStack Hermetic Build Kit

The complete --network=none build kit for this image — plus admin/DB/API handbooks, the build's validation records, and its build provenance records — is a free download for any registered account at readystack.dev/products/miniflux⁠. A clean-room rebuild from this release's archive on an egress-blocked host reproduced its linux/amd64 digest sha256:c4809ba317e5a207d6fd40e32f311f08303124d00df4ebe3b96a51906decec86 on 2026-10-27.

— ReadyStack · readystack.dev