[{"_1":2,"_235":-5,"_236":-5},"loaderData",{"_3":4,"_13":14,"_16":17,"_231":232},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5},"username","routes/_layout.r.$namespace.$reponame",{"_18":19,"_20":-5,"_21":11,"_22":11,"_23":24,"_25":26,"_27":-5,"_28":11,"_29":30,"_86":87,"_111":112,"_230":11},"canonicalUrl","https://hub.docker.com/r/cleanstart/nats/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","cleanstart","reponame","nats","cloudBuildSource","isAutobuildsAvailable","repo",{"_31":32,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_34":26,"_23":24,"_55":56,"_57":40,"_58":59,"_60":61,"_62":63,"_64":-5,"_65":59,"_66":67,"_68":11,"_69":24,"_70":71,"_76":11,"_77":78,"_83":24,"_84":85},"categories",[33],{"_34":35,"_36":37},"name","Message queues","slug","message-queues","content_types",[40],"image","date_registered","2025-04-01T07:10:01.80296Z","description","Secure by Design, Built for Speed, Hardened Container Images on a minimal base CleanStart OS.","is_private","last_updated","2026-02-06T03:32:17.441767Z","last_modified","2025-10-30T10:39:56.659844Z","media_types",[52,53,54],"application/vnd.oci.image.config.v1+json","application/vnd.docker.container.image.v1+json","application/vnd.docker.distribution.manifest.list.v2+json","pull_count",18832,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","

CleanStart Container for Nats

NATS is a simple, secure and high-performance open source messaging system for cloud native applications, IoT messaging, and microservices architectures. This container provides a production-ready NATS server with enhanced security features, monitoring capabilities, and enterprise-grade reliability. It includes the core NATS server, built-in security mechanisms like TLS support, authentication, and authorization controls, along with monitoring endpoints for operational visibility.

📌 CleanStart Foundation: Security-hardened, minimal base OS designed for enterprise containerized environments.

Key Features

High-performance publish-subscribe and request-reply messaging
Built-in authentication and authorization
TLS/SSL support for encrypted communications
Clustering support for high availability

Common Use Cases

Microservices communication backbone
Cloud messaging and event streaming
IoT device messaging and data collection
Real-time data distribution systems

Quick Start

Pull Latest Image\nDownload the container image from the registry

docker pull cleanstart/nats:latest\ndocker pull cleanstart/nats:latest-dev\n

Basic Run\nRun the container with basic configuration

docker run -d --name nats-server -p 4222:4222 cleanstart/nats:latest\n

Production Deployment\nDeploy with production security settings

docker run -d --name nats-prod \\\n  --read-only \\\n  --security-opt=no-new-privileges \\\n  --user 1000:1000 \\\n  -p 4222:4222 -p 8222:8222 \\\n  cleanstart/nats:latest\n

Volume Mount\nMount local directory for persistent data

docker run -d -v $(pwd)/nats-config:/etc/nats cleanstart/nats:latest\n

Port Forwarding\nRun with custom port mappings

docker run -d -p 4222:4222 -p 8222:8222 -p 6222:6222 cleanstart/nats:latest\n

Configuration

Environment Variables

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Variable	Default	Description
PATH	/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin	System PATH configuration
NATS_SERVER_CONFIG	/etc/nats/server.conf	Path to NATS server configuration file
NATS_CLIENT_PORT	4222	Port for client connections
NATS_MONITORING_PORT	8222	Port for HTTP monitoring interface

Security & Best Practices

Recommended Security Context

securityContext:\n  runAsNonRoot: true\n  runAsUser: 1000\n  runAsGroup: 1000\n  readOnlyRootFilesystem: true\n  allowPrivilegeEscalation: false\n  capabilities:\n    drop: ['ALL']\n

Best Practices

Use specific image tags for production (avoid latest)
Configure resource limits: memory and CPU constraints
Enable read-only root filesystem when possible
Run containers with non-root user (--user 1000:1000)
Use --security-opt=no-new-privileges flag
Regularly update container images for security patches
Implement proper network segmentation
Monitor container metrics for anomalies

Architecture Support

Multi-Platform Images

docker pull --platform linux/amd64 cleanstart/nats:latest\ndocker pull --platform linux/arm64 cleanstart/nats:latest\n

\n Resources & Documentation\n\n- **CleanStart Website**: [https://www.cleanstart.com](https://www.cleanstart.com) \n- **NATS Documentation**: [https://docs.nats.io](https://docs.nats.io) \n- **CleanStart Community Images**: [https://hub.docker.com/u/cleanstart](https://hub.docker.com/u/cleanstart) \n- **How-to-Run CleanStart Images & Sample Projects**: [ https://github.com/cleanstart-dev/cleanstart-containers](https://github.com/cleanstart-dev/cleanstart-containers),\n * how-to-Run sample projects using dockerfile \n * how-to-Deploy via Kubernete YAML \n * how-to-Migrate from public images to CleanStart images \n\n---\n\n## Vulnerability Disclaimer\n\nCleanStart offers Docker images that include third-party open-source libraries and packages maintained by independent contributors. While CleanStart maintains these images and applies industry-standard security practices, it cannot guarantee the security or integrity of upstream components beyond its control.\n\nUsers acknowledge and agree that open-source software may contain undiscovered vulnerabilities or introduce new risks through updates. CleanStart shall not be liable for security issues originating from third-party libraries, including but not limited to zero-day exploits, supply chain attacks, or contributor-introduced risks.\n\nSecurity remains a shared responsibility: CleanStart provides updated images and guidance where possible, while users are responsible for evaluating deployments and implementing appropriate controls.","has_starred","hub_user","immutable_tags_settings",{"_72":11,"_73":74},"enabled","rules",[75],".*","is_automated","permissions",{"_79":80,"_81":11,"_82":11},"read",true,"write","admin","user","storage_size",60197735915,"orgData",{"_88":89,"_90":91,"_92":93,"_94":24,"_95":96,"_97":98,"_99":96,"_100":101,"_102":103,"_104":105,"_106":107,"_108":109,"_110":80},"id","ea5a1da1200e4687990ce873c85e8455","uuid","ea5a1da1-200e-4687-990c-e873c85e8455","type","organization","orgname","full_name","CleanStart","location","USA","company","profile_url","https://www.cleanstart.com/","date_joined","2024-06-05T17:41:41.070258Z","gravatar_url","https://www.gravatar.com/avatar/73bdd9006d36d7bd16ec699382ddfba5?s=80&r=g&d=mm","gravatar_email","sanket_m@triamsecurity.com","badge","verified_publisher","is_active","recentTags",[113,152,159,170,176,186,195,204,212,220],{"_114":40,"_115":116,"_117":118,"_119":120,"_88":121,"_122":123,"_46":140,"_141":116,"_142":143,"_144":53,"_34":145,"_146":147,"_148":130,"_149":140,"_150":63,"_151":80},"content_type","creator",36657644,"digest","sha256:251c6a6a55bb386e9d7d3bf1b38dc6bb2696ffe3bec554b8992085bd1ca838ac","full_size",22064144,1018883265,"images",[124],{"_125":126,"_117":118,"_127":128,"_129":130,"_131":132,"_133":134,"_135":128,"_136":-5,"_137":120,"_60":63,"_138":139},"architecture","arm64","features","","last_pulled","2026-02-08T03:30:11.677218863Z","last_pushed","2026-02-06T03:31:55.773799731Z","os","linux","os_features","os_version","size","variant","v8","2026-02-06T03:32:16.379515Z","last_updater","last_updater_username","cleanstartadmin","media_type","2.12.2-arm64","repository",26909847,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_114":40,"_115":153,"_117":118,"_119":120,"_88":154,"_122":155,"_46":157,"_141":116,"_142":143,"_144":53,"_34":158,"_146":147,"_148":130,"_149":157,"_150":63,"_151":80},34498695,959516491,[156],{"_125":126,"_117":118,"_127":128,"_129":130,"_131":132,"_133":134,"_135":128,"_136":-5,"_137":120,"_60":63,"_138":139},"2026-02-06T03:32:14.443887Z","latest-arm64",{"_114":40,"_115":116,"_117":160,"_119":161,"_88":162,"_122":163,"_46":168,"_141":116,"_142":143,"_144":53,"_34":169,"_146":147,"_148":166,"_149":168,"_150":63,"_151":80},"sha256:0276106d0b68a5e0a5e0b9a3ba97d758210b58ea6cea060117f23b4ee6674f1a",22121674,1018883240,[164],{"_125":165,"_117":160,"_127":128,"_129":166,"_131":167,"_133":134,"_135":128,"_136":-5,"_137":161,"_60":63,"_138":-5},"amd64","2026-02-08T15:33:26.651593159Z","2026-02-06T03:31:47.789554975Z","2026-02-06T03:32:12.390488Z","2.12.2-amd64",{"_114":40,"_115":153,"_117":160,"_119":161,"_88":171,"_122":172,"_46":174,"_141":116,"_142":143,"_144":53,"_34":175,"_146":147,"_148":166,"_149":174,"_150":63,"_151":80},959516536,[173],{"_125":165,"_117":160,"_127":128,"_129":166,"_131":167,"_133":134,"_135":128,"_136":-5,"_137":161,"_60":63,"_138":-5},"2026-02-06T03:32:10.417162Z","latest-amd64",{"_114":40,"_115":116,"_117":177,"_119":178,"_88":179,"_122":180,"_46":184,"_141":116,"_142":143,"_144":52,"_34":185,"_146":147,"_148":182,"_149":184,"_150":63,"_151":80},"sha256:cea93b314125fe2080b959d5d60a58c821b76803f0b00f9e451010972bab274d",263,1068074165,[181],{"_125":128,"_117":177,"_127":128,"_129":182,"_131":183,"_133":128,"_135":128,"_136":-5,"_137":178,"_60":63,"_138":-5},"2026-02-08T03:30:10.666161046Z","2026-02-06T03:32:08.43710811Z","2026-02-06T03:32:08.565774Z","sha256-251c6a6a55bb386e9d7d3bf1b38dc6bb2696ffe3bec554b8992085bd1ca838ac.sig",{"_114":40,"_115":116,"_117":187,"_119":178,"_88":188,"_122":189,"_46":193,"_141":116,"_142":143,"_144":52,"_34":194,"_146":147,"_148":191,"_149":193,"_150":63,"_151":80},"sha256:bdb8321d81216370718ad6a8f8f3a8718f17a12ceae454f1874b9d9cdc9e5b4e",1068074135,[190],{"_125":128,"_117":187,"_127":128,"_129":191,"_131":192,"_133":128,"_135":128,"_136":-5,"_137":178,"_60":63,"_138":-5},"2026-02-08T03:30:10.189676369Z","2026-02-06T03:32:04.879990507Z","2026-02-06T03:32:05.033732Z","sha256-0276106d0b68a5e0a5e0b9a3ba97d758210b58ea6cea060117f23b4ee6674f1a.sig",{"_114":40,"_115":116,"_117":196,"_119":178,"_88":197,"_122":198,"_46":202,"_141":116,"_142":143,"_144":52,"_34":203,"_146":147,"_148":200,"_149":202,"_150":63,"_151":80},"sha256:7134ca235baf65f9b516eee73eb2e9288ee5826f70ede50a312eb92c39cef93c",1068074104,[199],{"_125":128,"_117":196,"_127":128,"_129":200,"_131":201,"_133":128,"_135":128,"_136":-5,"_137":178,"_60":63,"_138":-5},"2026-02-08T03:30:09.769391578Z","2026-02-06T03:32:01.260148041Z","2026-02-06T03:32:01.649006Z","sha256-4eb19eb4039cd0f540bbd7db546411b5f72e150b843f7415b27d2d064e9265ee.sig",{"_114":40,"_115":116,"_117":205,"_119":161,"_88":206,"_122":207,"_46":210,"_141":116,"_142":143,"_144":54,"_34":211,"_146":147,"_148":166,"_149":210,"_150":63,"_151":80},"sha256:4eb19eb4039cd0f540bbd7db546411b5f72e150b843f7415b27d2d064e9265ee",1018883104,[208,209],{"_125":165,"_117":160,"_127":128,"_129":166,"_131":167,"_133":134,"_135":128,"_136":-5,"_137":161,"_60":63,"_138":-5},{"_125":126,"_117":118,"_127":128,"_129":130,"_131":132,"_133":134,"_135":128,"_136":-5,"_137":120,"_60":63,"_138":139},"2026-02-06T03:31:58.07716Z","2.12.2",{"_114":40,"_115":213,"_117":205,"_119":161,"_88":214,"_122":215,"_46":218,"_141":116,"_142":143,"_144":54,"_34":219,"_146":147,"_148":166,"_149":218,"_150":63,"_151":80},27734815,943094798,[216,217],{"_125":165,"_117":160,"_127":128,"_129":166,"_131":167,"_133":134,"_135":128,"_136":-5,"_137":161,"_60":63,"_138":-5},{"_125":126,"_117":118,"_127":128,"_129":130,"_131":132,"_133":134,"_135":128,"_136":-5,"_137":120,"_60":63,"_138":139},"2026-02-06T03:31:56.340224Z","latest",{"_114":40,"_115":116,"_117":221,"_119":222,"_88":223,"_122":224,"_46":228,"_141":116,"_142":143,"_144":52,"_34":229,"_146":147,"_148":226,"_149":228,"_150":63,"_151":80},"sha256:e1533de35b34739b7c242a14df9794f516a3ce7724a5fa8a8061d88b6640614a",1147496,1068073867,[225],{"_125":128,"_117":221,"_127":128,"_129":226,"_131":227,"_133":128,"_135":128,"_136":-5,"_137":222,"_60":63,"_138":-5},"2026-02-08T03:30:08.197329136Z","2026-02-06T03:31:35.450058019Z","2026-02-06T03:31:35.647232Z","sha256-4eb19eb4039cd0f540bbd7db546411b5f72e150b843f7415b27d2d064e9265ee.att","isPotentialSpam","routes/_layout.r.$namespace.$reponame.tags",{"_233":80,"_234":11},"isRunInDesktopEnabled","canDeleteTags","actionData","errors"]