Base images
Pre-built, pre-pulled images for every pipeline step. Use any image you want — these are just faster.
How it works
Every pipeline step runs in a container. gittan provides base images that are pre-pulled on every runner — zero pull time. You can use any public or org-registry image instead, but you pay the pull time.
When you omit image: in your .gittan.yaml, auto-detection picks
the right gittan image based on your repo contents.
Every image includes
All gittan base images share a common layer with these tools pre-installed:
| Tool | Why |
|---|---|
| git | Workspace operations, submodules, version info |
| curl | Downloads, webhook notifications, health checks |
| jq | JSON processing in shell scripts |
| ca-certificates | HTTPS connections to registries and APIs |
Language runtimes
One image per language, multiple supported versions. Based on official upstream slim images with the gittan base layer added.
| Image | Versions | Includes | Auto-detected by |
|---|---|---|---|
| gittan/node | 22, 24 | npm, npx, corepack (pnpm, yarn) | package.json |
| gittan/python | 3.13, 3.14 | uv, pip, venv | pyproject.toml,requirements.txt |
| gittan/go | 1.24 | go toolchain, gcc | go.mod |
| gittan/rust | 1.81 | cargo, rustc, clippy | Cargo.toml |
| gittan/java | 21 | Eclipse Temurin JDK | pom.xml,build.gradle |
| gittan/dotnet | 9 | dotnet SDK, NuGet | *.csproj,*.sln |
| gittan/ruby | 3.4 | bundler, gem | Gemfile |
| gittan/php | 8.4 | PHP CLI | composer.json |
| gittan/elixir | 1.18 | mix, hex | mix.exs |
Platform images
For repos that aren't application code — infrastructure, GitOps config, static sites. These include domain-specific toolchains instead of language runtimes.
| Image | Includes | Auto-detected by |
|---|---|---|
| gittan/docker | docker CLI (builds via Dagger, not docker-in-docker) | Dockerfile |
| gittan/kube-tools | kubeconform, kyverno, kustomize | kustomization.yaml |
| gittan/pulumi | Pulumi CLI, Node.js runtime | Pulumi.yaml |
| gittan/infra | Terraform CLI | main.tf |
| gittan/gitops | Helm CLI | Chart.yaml |
| gittan/static | Hugo extended edition | hugo.toml,hugo.yaml |
Tool images
Used by org-level policies to inject mandatory steps. Not typically referenced
in .gittan.yaml directly — they run
because a policy says so.
| Image | Purpose |
|---|---|
| gittan/gitleaks | Secret scanning — finds hardcoded tokens, passwords, API keys |
| gittan/trivy | Vulnerability scanning — CVEs in dependencies and container images |
| gittan/kubeconform | Kubernetes manifest validation against schemas |
| gittan/kyverno | Policy validation — security baselines, best practices |
| gittan/cosign | Container image signing and provenance attestation |
Using your own image
Any image works. Use a public registry or push to your org's images.gittan.eu registry.
steps:
- name: convert
image: jrottenberg/ffmpeg:7-slim
run: ffmpeg -i input.mp4 -vf scale=1280:720 output.mp4The same sandbox applies regardless of image. Your container runs with a read-only root filesystem, no network access (except during dependency install), dropped capabilities, and resource limits. There is no way to install additional packages at runtime or reach internal infrastructure.
gittan images are faster because they are pre-pulled on every runner. External images are pulled on demand — the pull time shows in your pipeline output so you see the cost.
Provenance
Every gittan base image is built with a verified provenance chain: the upstream image signature is verified before build, the resulting image is signed with keyless Sigstore using the build pipeline's OIDC identity, and the runner verifies the signature before running any step. A tampered or unsigned image never executes.
See supply chain security for the full verification chain.
Version pinning
gittan images use major-version tags (gittan/node:22)
that resolve to a specific digest internally. The digest is updated when security patches
land upstream, but the API surface stays stable within a major version.
For external images, you must provide a digest or a version tag. :latest is rejected.
See image pinning for details.
Requesting a new image
Need a language or tool that isn't listed? Open an issue or contact the gittan team. New images are added when there is real demand — we do not maintain images nobody uses.