randomcontainers builds up-to-date container images for open-source software, starting with command-line tools that have no official image or none that keeps up with upstream releases. The images are built on Ubuntu and Alpine for linux/amd64 and linux/arm64, run as a non-root user and come with build provenance attestations. They are unofficial builds, not affiliated with or endorsed by the upstream projects.
| Image | What it does | latest includes |
|---|---|---|
| yt-dlp | Downloads video and audio from YouTube and many other sites | yt-dlp, FFmpeg, Deno |
| streamlink | Saves live streams from Twitch, YouTube and other sites | Streamlink, FFmpeg |
| ffmpeg | Converts, filters and streams audio and video | FFmpeg |
| mediainfo | Reports the codecs, bit rates and tracks of video and audio files | MediaInfo, FFmpeg |
| mkvtoolnix | Creates, edits and extracts from Matroska and WebM files | MKVToolNix, FFmpeg, MediaInfo |
| whisper-cpp | Transcribes and translates speech on the CPU (models not included) | whisper.cpp, FFmpeg |
| vmaf | Scores the quality of an encoded video against its source | VMAF, FFmpeg |
| audiowaveform | Generates waveform data and images from audio files | audiowaveform, FFmpeg |
| srt | Streams live video, sends files and tunnels TCP over SRT | SRT tools, FFmpeg |
| shaka-packager | Packages and encrypts video, audio and subtitles for DASH and HLS streaming | Shaka Packager, FFmpeg |
| Image | What it does | latest includes |
|---|---|---|
| imagemagick | Converts and edits images | ImageMagick, Ghostscript |
| exiftool | Reads, writes and removes metadata in images, video and documents | ExifTool, ImageMagick |
| jpegoptim | Makes JPEG files smaller | jpegoptim, ImageMagick |
| libjpeg-turbo | Rotates, crops and optimizes JPEG files losslessly, and converts images to and from JPEG | libjpeg-turbo, ExifTool |
| libheif | Converts HEIC and AVIF photos, and encodes images as HEIC or AVIF | libheif, ExifTool |
| libvips | Converts, resizes and makes thumbnails of images, including very large ones | libvips |
| Image | What it does | latest includes |
|---|---|---|
| ghostscript | Renders and converts PostScript and PDF files | Ghostscript |
| qpdf | Merges, splits, encrypts and repairs PDF files | qpdf, Ghostscript |
| mupdf | Renders, converts and edits PDF files, and converts EPUB and XPS | MuPDF |
| poppler | Extracts text and images from PDF files and renders their pages | Poppler |
| tesseract | Reads text in scans and photos (OCR), with the English model | Tesseract, Poppler |
| weasyprint | Turns HTML and CSS into PDF documents laid out for print | WeasyPrint, qpdf |
| Image | What it does | latest includes |
|---|---|---|
| graphviz | Draws graphs written in the DOT language | Graphviz |
| doxygen | Generates documentation from comments in source code | Doxygen, Graphviz |
| sphinx | Builds documentation from reStructuredText into HTML, LaTeX, ePub and man pages | Sphinx, Graphviz |
| yamllint | Checks YAML files for syntax errors and formatting problems | yamllint |
| check-jsonschema | Validates JSON, YAML and TOML files against a JSON Schema, with schemas for CI configuration | check-jsonschema |
| jsonnet | Evaluates, formats and lints Jsonnet configuration | Jsonnet (Go implementation) |
| libxml2 | Checks, validates, formats and transforms XML files | libxml2, libxslt |
| codespell | Finds and fixes common misspellings in source code and documentation | codespell |
| vale | Checks prose in Markdown, HTML and code comments against your style rules (styles not included) | Vale |
| clang-format | Formats C, C++, Java, JavaScript and other source code to a configured style | clang-format |
| cppcheck | Finds bugs and undefined behavior in C and C++ code by static analysis | Cppcheck |
| protoc | Generates code from Protocol Buffers .proto files | protoc |
| duckdb | Runs SQL queries on CSV, Parquet and JSON files and on DuckDB databases | DuckDB |
| Image | What it does | latest includes |
|---|---|---|
| 7zip | Creates and extracts 7z, zip, tar and many other archives | 7-Zip |
| rsync | Copies and synchronizes files, sending only what changed | rsync |
| openssh-client | Logs in to SSH servers, copies files with scp and sftp, and manages keys | OpenSSH client |
| iperf3 | Measures network throughput between two hosts | iperf3 |
| nmap | Discovers hosts and services and scans ports, with Ncat and Nping | Nmap |
| dig | Queries DNS servers and sends dynamic updates | BIND 9 client tools |
| tcpdump | Captures and decodes network packets | tcpdump |
| tshark | Captures and decodes network traffic with Wireshark's dissectors, without the GUI | TShark, tcpdump |
| openssl | Makes keys and certificates and tests TLS connections | OpenSSL |
The default images that add other tools are also published under their own names, with the same contents and no slim tags: yt-dlp-ffmpeg, streamlink-ffmpeg, mediainfo-ffmpeg, mkvtoolnix-ffmpeg-mediainfo, whisper-cpp-ffmpeg, vmaf-ffmpeg, audiowaveform-ffmpeg, srt-ffmpeg, shaka-packager-ffmpeg, imagemagick-ghostscript, exiftool-imagemagick, jpegoptim-imagemagick, libjpeg-turbo-exiftool, libheif-exiftool, qpdf-ghostscript, tesseract-poppler, weasyprint-qpdf, doxygen-graphviz, sphinx-graphviz and tshark-tcpdump. check-jsonschema-yamllint is published the same way but is not a default image: it adds yamllint to check-jsonschema. Where a default image adds another tool from this list, it is that tool's slim build: ImageMagick in exiftool and jpegoptim, for example, has no Ghostscript.
The images are published to the GitHub Container Registry as ghcr.io/randomcontainers/<name>:
docker pull ghcr.io/randomcontainers/yt-dlplatest is the tool plus what it most often needs, so common tasks work without extra setup. slim is the tool and its own runtime dependencies only, for building your own image on a base that stays up to date. Tools that need nothing extra, such as FFmpeg, Ghostscript and Nmap, have the same image under latest and slim.
Alpine builds are tagged alpine and slim-alpine. Each image's README lists every tag.
A new upstream release is picked up once it is a day old. Between releases, the tags of each tool's current version are rebuilt when the base image changes and at least every 7 days, and the default tags also when a tool included in the default image changes. Tags of older versions stay as they were last built. Tags that name a distro release, such as <version>-ubuntu26.04, are no longer rebuilt once the images move to the next release. Because tags are rebuilt in place, pin a digest where you need the same image every time. Each image's README describes how its upstream releases are picked up.
Every image is built in the repository of the same name, and its attestation is signed by the shared build workflow in randomcontainers/ci. The GitHub CLI needs both repositories to check it:
gh attestation verify oci://ghcr.io/randomcontainers/<name>:<tag> \
--repo randomcontainers/<name> --signer-repo randomcontainers/ciTo suggest a tool, use the Request a tool form. CONTRIBUTING.md describes what makes a good fit and how packages are built.