Sign inSign up

cleanstart/envoy

Verified Publisher

By CleanStart

•Updated about 21 hours ago

Secure by Design, Built for Speed, Hardened Container Images on a minimal base CleanStart OS.

Image
Networking
Security
Monitoring & observability
0

50K+

cleanstart/envoy repository overview

Verified ENVOY Container Image

A hardened, minimal ENVOY container image built from source with verifiable software provenance and an SBOM, designed for secure production deployments.

For additional versions including FIPS support, explore CleanStart Images — secure, hardened container images⁠

⁠Pull Latest Image

Download the container image from the registry

docker pull cleanstart/envoy:latest

docker pull cleanstart/envoy:latest-dev

⁠Minimal envoy.yaml Example

A minimal configuration to get Envoy running on port 8080 with an admin interface on port 9901:

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 8080
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match:
                  prefix: "/"
                direct_response:
                  status: 200
                  body:
                    inline_string: "Envoy is running\n"
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

admin:
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 9901

# Note: check port availability

⁠Basic Run

Run the container with basic configuration

docker run -it --name envoy \
  -v ~/envoy.yaml:/etc/envoy/envoy.yaml:ro \
  cleanstart/envoy:latest \
  envoy -c /etc/envoy/envoy.yaml

⁠Production Deployment

Deploy with production security settings

docker run -d --name envoy-prod \
  --security-opt=no-new-privileges \
  --user 1000:1000 \
  --restart unless-stopped \
  -p 8080:8080 \
  -p 9901:9901 \
  -v ~/envoy.yaml:/etc/envoy/envoy.yaml:ro \
  cleanstart/envoy:latest \
  envoy -c /etc/envoy/envoy.yaml

Volume Mount Mount local directory for persistent data

docker run \
  -v /app:/app \
  -v ~/envoy.yaml:/etc/envoy/envoy.yaml:ro \
  cleanstart/envoy:latest \
  envoy -c /etc/envoy/envoy.yaml

Port Forwarding Run with custom port mappings

docker run \
  -p 8080:8080 \
  -p 9901:9901 \
  -v ~/envoy.yaml:/etc/envoy/envoy.yaml:ro \
  cleanstart/envoy:latest \
  envoy -c /etc/envoy/envoy.yaml

⁠Verify the Container

curl http://localhost:8080
⁠Expected output: Envoy is running

⁠Check the admin endpoint health

curl http://localhost:9901/ready
⁠Expected output: LIVE

Why Use CleanStart Images⁠

  • Verified — Built from source with verifiable software provenance
  • Hardened — Minimal software footprint designed for secure deployment
  • Transparent — SBOM available for visibility into image contents
  • Production-ready — Built for modern container environments

Tag summary

Content type

Image

Digest

sha256:0168827d4…

Size

120.3 MB

Last updated

about 21 hours ago

docker pull cleanstart/envoy