v0.4.2regionus-east-1builds/7d41pipeline active

FLA / PUBLIC BETA

DOCS / COMPARE

$flareo position --honest# where we fit, where we don't

NOT THE ONLY
CONTAINER PLATFORM.

Flareo isn't trying to replace Docker Hub, out-harden Chainguard, or compete with Railway. It fills a specific gap: verified self-hosting — the only category where supply-chain rigor meets "run it on your own box" freedom. Here's the full landscape, honestly.

§ LANDSCAPE MAP

Two axes. Seven players.

Vertical axis: verification rigor. Horizontal axis: self-host freedom.

LEGEND

FLAREO

Docker Hub / GHCR

Chainguard Images

Wolfi / base distros

Linuxserver.io

Railway / PaaS

home-grown pipelines

01FLAREO vs.

Docker Hub & GHCR

roledefault registriesuserseveryone

CATEGORYdifferent layer

THEY'RE GOOD AT

+Massive catalog. Millions of images, every project has an official image, every base language is represented.

+Free public hosting, great CDN, works with every container runtime.

+De-facto universal. Every docker pull tutorial assumes Docker Hub or GHCR.

WHAT THEY'RE NOT

−No verification. Anyone can push anything, the :latest tag can change under you, and publisher identity isn't cryptographically bound.

−No SBOM, no provenance attestation. You can't answer "what's inside this image" without scanning it yourself.

−Docker Content Trust exists but is rarely used and doesn't cover provenance.

WHEN FLAREO FITS

→Flareo doesn't replace these — we publish to GHCR. We add the verification layer on top.

→Use Flareo when you need supply-chain guarantees. Use Docker Hub for ephemeral build bases.

02FLAREO vs.

Chainguard Images

rolehardened enterprise imagesuserssecurity teams at mid+ companies

CATEGORYadjacent · audience differs

THEY'RE GOOD AT

+Industry-leading hardening. Distroless images, minimal attack surface, FIPS-validated builds.

+Full supply-chain coverage: SBOM, SLSA L3, signatures, continuous CVE patching by a dedicated team.

+Enterprise-grade support, compliance attestations, audit-ready documentation.

WHAT THEY'RE NOT

−Priced for enterprise. Free tier is intentionally limited; full catalog starts in the four-to-six-figure annual range.

−Focused on base images and language runtimes. Won't build you a ready-to-run Vaultwarden.

−Not optimized for self-hosters. Their customer is a Fortune-500 security team.

WHEN FLAREO FITS

→Different audience. Flareo is for individual operators and small teams. Chainguard is for enterprises.

→If you're paying Chainguard pricing, they're probably a better fit. If you want verified containers for a Hetzner box, Flareo.

03FLAREO vs.

Wolfi & base distributions

rolecontainer-first Linux distrousersimage builders

CATEGORYdifferent layer

THEY'RE GOOD AT

+Excellent building blocks. Minimal, CVE-free base images you can build your own application images on.

+Every package signed, every release reproducible, SBOMs everywhere. The distribution is the verification story.

WHAT THEY'RE NOT

−Not application distribution. Wolfi hands you a bag of LEGO bricks; you still have to build the castle.

−Requires you to author the Dockerfile and own the build pipeline yourself.

WHEN FLAREO FITS

→Complementary. Publishers can build on Wolfi bases, then submit to Flareo. Wolfi is a supplier; Flareo is a distributor.

04FLAREO vs.

Linuxserver.io

rolecommunity self-hosting catalogusershomelab operators

CATEGORYsame audience · different guarantees

THEY'RE GOOD AT

+Enormous catalog. Hundreds of images, every popular self-hosted app covered, opinionated packaging.

+Community maintained, generally high quality. Strong documentation, predictable env-var schema.

WHAT THEY'RE NOT

−No formal verification. No SBOMs, no signatures, no provenance. Trust is community reputation, not cryptography.

−Mutable tags. The image behind linuxserver/gitea:latest today is not the same one you pulled last week.

WHEN FLAREO FITS

→Same self-hoster audience. Choose Flareo when cryptographic verification matters — compliance, teams, production.

→Choose LSIO when you need the widest possible catalog today and you're comfortable trusting community reputation.

05FLAREO vs.

Railway · Render · Fly.io

roledeploy-for-you PaaSusersdevelopers who don't want to ops

CATEGORYopposite trade-off

THEY'RE GOOD AT

+Zero-ops deployment. Push code, get a URL. No Docker knowledge needed, no compose file, no infrastructure.

+Managed scaling, integrated observability, automatic TLS, one-click database provisioning.

WHAT THEY'RE NOT

−Tenancy. You run on their infrastructure, pay their egress, are subject to their pricing.

−No supply-chain transparency. Runtime opacity is the product — you don't see how images are built.

WHEN FLAREO FITS

→Opposite trade-off. Flareo gives you the compose file and walks away. Your infrastructure, your bill, your control.

→Pick Railway when the convenience is worth the lock-in. Pick Flareo when you're done with tenancy.

06FLAREO vs.

Your own pipeline

rolehome-grown CI setupusersplatform teams with capacity

CATEGORYdo-it-yourself option

THEY'RE GOOD AT

+Total control. Your CI, your policies, your trust decisions. Every tool chosen deliberately for your threat model.

+Integrates with whatever else you run. If you already use Renovate, Backstage, Artifactory — it slots in cleanly.

WHAT THEY'RE NOT

−Zero catalog leverage. You're only building images for your apps. No network effect of a shared verified catalog.

−Cost of operation. Running your own cosign + Trivy + SLSA pipeline takes a platform engineer at least a quarter.

WHEN FLAREO FITS

→Use Flareo for third-party applications. Use your own pipeline for internal services. They coexist.

→Every Flareo module ships with the full SLSA/SBOM/cosign stack your own pipeline was going to generate anyway.

§ WHEN NOT TO USE FLAREO

Honest disqualifiers.

Four scenarios where Flareo is genuinely the wrong choice. Use the alternative we point to.

You need a FIPS-validated cryptographic runtime.

We don't ship FIPS-140-2 validated crypto modules. If that's a hard compliance requirement, Chainguard ships FIPS images.

alternative →chainguard.dev · enterprise

You want zero-ops, push-to-deploy, don't care about infrastructure.

Flareo hands you a compose file and leaves. If you want to git-push and get a live URL, a PaaS will be dramatically less friction.

alternative →railway.com · render.com · fly.io

You need the biggest possible catalog today.

We're at 12 verified modules. We won't match Linuxserver.io's catalog breadth for a while. If you need Plex, Sonarr, Radarr this week, LSIO has them.

alternative →linuxserver.io · community

You're distributing images only inside your own company.

Flareo is a public registry. For internal-only images use your own CI with cosign + SLSA, or a private registry.

alternative →harbor.goharbor.io · artifactory

THE ONE-LINE VERSION

Flareo is the only place where cryptographically verified containers meet bring your own box.

Everyone else either gives you verification but takes your infrastructure, or gives you freedom but not verification. We sit in the overlap.

DOCS / COMPARE

$flareo position --honest# where we fit, where we don't

NOT THE ONLY
CONTAINER PLATFORM.

§ LANDSCAPE MAP

Two axes. Seven players.

Vertical axis: verification rigor. Horizontal axis: self-host freedom.

LEGEND

FLAREO

Docker Hub / GHCR

Chainguard Images

Wolfi / base distros

Linuxserver.io

Railway / PaaS

home-grown pipelines

01FLAREO vs.

Docker Hub & GHCR

roledefault registriesuserseveryone

CATEGORYdifferent layer

THEY'RE GOOD AT

+Massive catalog. Millions of images, every project has an official image, every base language is represented.

+Free public hosting, great CDN, works with every container runtime.

+De-facto universal. Every docker pull tutorial assumes Docker Hub or GHCR.

WHAT THEY'RE NOT

−No verification. Anyone can push anything, the :latest tag can change under you, and publisher identity isn't cryptographically bound.

−No SBOM, no provenance attestation. You can't answer "what's inside this image" without scanning it yourself.

−Docker Content Trust exists but is rarely used and doesn't cover provenance.

WHEN FLAREO FITS

→Flareo doesn't replace these — we publish to GHCR. We add the verification layer on top.

→Use Flareo when you need supply-chain guarantees. Use Docker Hub for ephemeral build bases.

02FLAREO vs.

Chainguard Images

rolehardened enterprise imagesuserssecurity teams at mid+ companies

CATEGORYadjacent · audience differs

THEY'RE GOOD AT

+Industry-leading hardening. Distroless images, minimal attack surface, FIPS-validated builds.

+Full supply-chain coverage: SBOM, SLSA L3, signatures, continuous CVE patching by a dedicated team.

+Enterprise-grade support, compliance attestations, audit-ready documentation.

WHAT THEY'RE NOT

−Priced for enterprise. Free tier is intentionally limited; full catalog starts in the four-to-six-figure annual range.

−Focused on base images and language runtimes. Won't build you a ready-to-run Vaultwarden.

−Not optimized for self-hosters. Their customer is a Fortune-500 security team.

WHEN FLAREO FITS

→Different audience. Flareo is for individual operators and small teams. Chainguard is for enterprises.

→If you're paying Chainguard pricing, they're probably a better fit. If you want verified containers for a Hetzner box, Flareo.

03FLAREO vs.

Wolfi & base distributions

rolecontainer-first Linux distrousersimage builders

CATEGORYdifferent layer

THEY'RE GOOD AT

+Excellent building blocks. Minimal, CVE-free base images you can build your own application images on.

+Every package signed, every release reproducible, SBOMs everywhere. The distribution is the verification story.

WHAT THEY'RE NOT

−Not application distribution. Wolfi hands you a bag of LEGO bricks; you still have to build the castle.

−Requires you to author the Dockerfile and own the build pipeline yourself.

WHEN FLAREO FITS

→Complementary. Publishers can build on Wolfi bases, then submit to Flareo. Wolfi is a supplier; Flareo is a distributor.

04FLAREO vs.

Linuxserver.io

rolecommunity self-hosting catalogusershomelab operators

CATEGORYsame audience · different guarantees

THEY'RE GOOD AT

+Enormous catalog. Hundreds of images, every popular self-hosted app covered, opinionated packaging.

+Community maintained, generally high quality. Strong documentation, predictable env-var schema.

WHAT THEY'RE NOT

−No formal verification. No SBOMs, no signatures, no provenance. Trust is community reputation, not cryptography.

−Mutable tags. The image behind linuxserver/gitea:latest today is not the same one you pulled last week.

WHEN FLAREO FITS

→Same self-hoster audience. Choose Flareo when cryptographic verification matters — compliance, teams, production.

→Choose LSIO when you need the widest possible catalog today and you're comfortable trusting community reputation.

05FLAREO vs.

Railway · Render · Fly.io

roledeploy-for-you PaaSusersdevelopers who don't want to ops

CATEGORYopposite trade-off

THEY'RE GOOD AT

+Zero-ops deployment. Push code, get a URL. No Docker knowledge needed, no compose file, no infrastructure.

+Managed scaling, integrated observability, automatic TLS, one-click database provisioning.

WHAT THEY'RE NOT

−Tenancy. You run on their infrastructure, pay their egress, are subject to their pricing.

−No supply-chain transparency. Runtime opacity is the product — you don't see how images are built.

WHEN FLAREO FITS

→Opposite trade-off. Flareo gives you the compose file and walks away. Your infrastructure, your bill, your control.

→Pick Railway when the convenience is worth the lock-in. Pick Flareo when you're done with tenancy.

06FLAREO vs.

Your own pipeline

rolehome-grown CI setupusersplatform teams with capacity

CATEGORYdo-it-yourself option

THEY'RE GOOD AT

+Total control. Your CI, your policies, your trust decisions. Every tool chosen deliberately for your threat model.

+Integrates with whatever else you run. If you already use Renovate, Backstage, Artifactory — it slots in cleanly.

WHAT THEY'RE NOT

−Zero catalog leverage. You're only building images for your apps. No network effect of a shared verified catalog.

−Cost of operation. Running your own cosign + Trivy + SLSA pipeline takes a platform engineer at least a quarter.

WHEN FLAREO FITS

→Use Flareo for third-party applications. Use your own pipeline for internal services. They coexist.

→Every Flareo module ships with the full SLSA/SBOM/cosign stack your own pipeline was going to generate anyway.

§ WHEN NOT TO USE FLAREO

Honest disqualifiers.

Four scenarios where Flareo is genuinely the wrong choice. Use the alternative we point to.

You need a FIPS-validated cryptographic runtime.

We don't ship FIPS-140-2 validated crypto modules. If that's a hard compliance requirement, Chainguard ships FIPS images.

alternative →chainguard.dev · enterprise

You want zero-ops, push-to-deploy, don't care about infrastructure.

Flareo hands you a compose file and leaves. If you want to git-push and get a live URL, a PaaS will be dramatically less friction.

alternative →railway.com · render.com · fly.io

You need the biggest possible catalog today.

We're at 12 verified modules. We won't match Linuxserver.io's catalog breadth for a while. If you need Plex, Sonarr, Radarr this week, LSIO has them.

alternative →linuxserver.io · community

You're distributing images only inside your own company.

Flareo is a public registry. For internal-only images use your own CI with cosign + SLSA, or a private registry.

alternative →harbor.goharbor.io · artifactory

THE ONE-LINE VERSION

Flareo is the only place where cryptographically verified containers meet bring your own box.

Everyone else either gives you verification but takes your infrastructure, or gives you freedom but not verification. We sit in the overlap.

NOT THE ONLYCONTAINER PLATFORM.

Two axes. Seven players.

Docker Hub & GHCR

Chainguard Images

Wolfi & base distributions

Linuxserver.io

Railway · Render · Fly.io

Your own pipeline

Honest disqualifiers.

You need a FIPS-validated cryptographic runtime.

You want zero-ops, push-to-deploy, don't care about infrastructure.

You need the biggest possible catalog today.

You're distributing images only inside your own company.

Flareo is the only place where cryptographically verified containers meet bring your own box.

NOT THE ONLYCONTAINER PLATFORM.

Two axes. Seven players.

Docker Hub & GHCR

Chainguard Images

Wolfi & base distributions

Linuxserver.io

Railway · Render · Fly.io

Your own pipeline

Honest disqualifiers.

You need a FIPS-validated cryptographic runtime.

You want zero-ops, push-to-deploy, don't care about infrastructure.

You need the biggest possible catalog today.

You're distributing images only inside your own company.

Flareo is the only place where cryptographically verified containers meet bring your own box.

NOT THE ONLY
CONTAINER PLATFORM.

NOT THE ONLY
CONTAINER PLATFORM.