diff --git a/.github/scripts/prepare-matrices.py b/.github/scripts/prepare-matrices.py
index 6f9677172..47dd81864 100644
--- a/.github/scripts/prepare-matrices.py
+++ b/.github/scripts/prepare-matrices.py
@@ -101,7 +101,7 @@ def get_image_metadata(subdir, meta, forRelease=False, force=False, channels=Non
 
         # Image Tags
         toBuild["tags"] = ["rolling", version]
-        if meta.get("semantic_versioning", False):
+        if meta.get("semver", False):
             parts = version.split(".")[:-1]
             while len(parts) > 0:
                 toBuild["tags"].append(".".join(parts))
@@ -125,11 +125,7 @@ def get_image_metadata(subdir, meta, forRelease=False, force=False, channels=Non
             platformToBuild["target_arch"] = target_arch
             platformToBuild["version"] = version
             platformToBuild["channel"] = channel["name"]
-
-            if meta.get("base", False):
-                platformToBuild["label_type"] ="org.opencontainers.image.base"
-            else:
-                platformToBuild["label_type"]="org.opencontainers.image"
+            platformToBuild["label_type"]="org.opencontainers.image"
 
             if isfile(os.path.join(subdir, channel["name"], "Dockerfile")):
                 platformToBuild["dockerfile"] = os.path.join(subdir, channel["name"], "Dockerfile")
diff --git a/.github/scripts/render-readme.py b/.github/scripts/render-readme.py
index 4bf9a9398..f161a504d 100644
--- a/.github/scripts/render-readme.py
+++ b/.github/scripts/render-readme.py
@@ -29,7 +29,6 @@ def load_metadata_file(file_path):
     return None
 
 if __name__ == "__main__":
-    base_images = []
     app_images = []
     for subdir, dirs, files in os.walk("./apps"):
         for file in files:
@@ -48,11 +47,9 @@ def load_metadata_file(file_path):
                     "html_url": f"https://github.com/{repo_name}/pkgs/container/{name}",
                     "owner": repo_owner
                 }
-                if meta["base"]:
-                    base_images.append(image)
-                else:
-                    app_images.append(image)
+
+                app_images.append(image)
 
     template = env.get_template("README.md.j2")
     with open("./README.md", "w") as f:
-        f.write(template.render(base_images=base_images, app_images=app_images))
+        f.write(template.render(app_images=app_images))
diff --git a/.github/scripts/templates/README.md.j2 b/.github/scripts/templates/README.md.j2
index 6353fb996..c9a061cde 100644
--- a/.github/scripts/templates/README.md.j2
+++ b/.github/scripts/templates/README.md.j2
@@ -19,13 +19,13 @@ _An opinionated collection of container images_
 
 </div>
 
-Welcome to our container images, if looking for a container start by [browsing the GitHub Packages page for this repo's packages](https://github.com/onedr0p?tab=packages&repo_name=containers).
+Welcome to my container images, if looking for a container start by [browsing the GitHub Packages page for this repo's packages](https://github.com/onedr0p?tab=packages&repo_name=containers).
 
 ## Mission statement
 
 The goal of this project is to support [semantically versioned](https://semver.org/), [rootless](https://rootlesscontaine.rs/), and [multiple architecture](https://www.docker.com/blog/multi-arch-build-and-images-the-simple-way/) containers for various applications.
 
-We also try to adhere to a [KISS principle](https://en.wikipedia.org/wiki/KISS_principle), logging to stdout, [one process per container](https://testdriven.io/tips/59de3279-4a2d-4556-9cd0-b444249ed31e/), no [s6-overlay](https://github.com/just-containers/s6-overlay) and all images are built on top of [Alpine](https://hub.docker.com/_/alpine) or [Ubuntu](https://hub.docker.com/_/ubuntu).
+It also adheres to a [KISS principle](https://en.wikipedia.org/wiki/KISS_principle), logging to stdout, [one process per container](https://testdriven.io/tips/59de3279-4a2d-4556-9cd0-b444249ed31e/), no [s6-overlay](https://github.com/just-containers/s6-overlay) and all images are built on top of [Alpine](https://hub.docker.com/_/alpine) or [Ubuntu](https://hub.docker.com/_/ubuntu).
 
 ## Tag immutability
 
@@ -89,16 +89,12 @@ Container | Channel | Image
 
 Here's an example of how tags are created in the GitHub workflows, be careful with `metadata.json` as it does affect the outcome of how the tags will be created when the application is built.
 
-| Application | Channel   | Stable  | Base    | Generated Tag               |
-|-------------|-----------|---------|---------|-----------------------------|
-| `ubuntu`    | `focal`   | `true`  | `true`  | `ubuntu:focal-rolling`      |
-| `ubuntu`    | `focal`   | `true`  | `true`  | `ubuntu:focal-19880312`     |
-| `alpine`    | `3.16`    | `true`  | `true`  | `alpine:rolling`            |
-| `alpine`    | `3.16`    | `true`  | `true`  | `alpine:3.16.0`             |
-| `sonarr`    | `develop` | `false` | `false` | `sonarr-develop:3.0.8.1538` |
-| `sonarr`    | `develop` | `false` | `false` | `sonarr-develop:rolling`    |
-| `sonarr`    | `main`    | `true`  | `false` | `sonarr:3.0.8.1507`         |
-| `sonarr`    | `main`    | `true`  | `false` | `sonarr:rolling`            |
+| Application | Channel   | Stable  | Generated Tag               |
+|-------------|-----------|---------|-----------------------------|
+| `sonarr`    | `develop` | `false` | `sonarr-develop:3.0.8.1538` |
+| `sonarr`    | `develop` | `false` | `sonarr-develop:rolling`    |
+| `sonarr`    | `main`    | `true`  | `sonarr:3.0.8.1507`         |
+| `sonarr`    | `main`    | `true`  | `sonarr:rolling`            |
 
 ## Deprecations
 
diff --git a/Taskfile.yml b/Taskfile.yml
index 2fefdd3b0..5d1419cfe 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -12,7 +12,7 @@ tasks:
 
   test:
     desc: |-
-      task APP=<app> CHANNEL=<channel> BASE=<true/false> test
+      task APP=<app> CHANNEL=<channel> test
     cmds:
       - task: download-goss
       - >-
@@ -29,7 +29,7 @@ tasks:
         {{end}}
         -f ./apps/{{.APP}}/Dockerfile .
       - >-
-        ./.goss/dgoss run {{.APP}}:{{.CHANNEL}} {{if eq .BASE "true"}}tail -f /dev/null{{end}}
+        ./.goss/dgoss run {{.APP}}:{{.CHANNEL}}
     env:
       CONTAINER_RUNTIME: docker
       GOSS_PATH: ./.goss/goss
diff --git a/apps/actions-runner/Dockerfile b/apps/actions-runner/Dockerfile
index 2a93e9db9..4653a9b3c 100644
--- a/apps/actions-runner/Dockerfile
+++ b/apps/actions-runner/Dockerfile
@@ -11,9 +11,9 @@ ENV HOMEBREW_NO_ANALYTICS=1 \
 USER root
 
 RUN \
-    apt-get update && apt-get upgrade -y \
+    apt-get update \
     && \
-    apt-get install -y --no-install-recommends \
+    apt-get install -y --no-install-recommends --no-install-suggests \
         ca-certificates \
         curl \
         gcc \
diff --git a/apps/actions-runner/metadata.yaml b/apps/actions-runner/metadata.yaml
index b4ba87d7d..2ea4235ac 100644
--- a/apps/actions-runner/metadata.yaml
+++ b/apps/actions-runner/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: actions-runner
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: stable
     platforms: ["linux/amd64"]
diff --git a/apps/alpine/Dockerfile b/apps/alpine/Dockerfile
deleted file mode 100644
index e9456acdf..000000000
--- a/apps/alpine/Dockerfile
+++ /dev/null
@@ -1,64 +0,0 @@
-ARG VERSION
-FROM docker.io/library/alpine:3.19 as builder
-ARG VERSION
-ARG TARGETOS
-ARG TARGETARCH
-ARG TARGETVARIANT=""
-ARG TARGETPLATFORM
-ENV GO111MODULE=on \
-    CGO_ENABLED=0 \
-    GOOS=${TARGETOS} \
-    GOARCH=${TARGETARCH} \
-    GOARM=${TARGETVARIANT} \
-    GOPATH=/go
-ENV PATH $GOPATH/bin:$PATH
-#hadolint ignore=DL3018
-RUN \
-    apk add --no-cache go upx \
-    && go install -ldflags="-s -w" github.com/drone/envsubst/cmd/envsubst@latest \
-    && upx /go/bin/envsubst
-
-FROM docker.io/library/alpine:${VERSION}
-ARG VERSION
-ARG CHANNEL
-ARG TARGETPLATFORM
-ENV TARGETPLATFORM=${TARGETPLATFORM:-linux/amd64}
-
-ENV UMASK="0002" \
-    TZ="Etc/UTC"
-
-WORKDIR /app
-
-# hadolint ignore=DL3002
-USER root
-
-#hadolint ignore=DL3018
-RUN \
-    apk add --no-cache \
-        ca-certificates catatonit bash \
-        bind-tools coreutils curl iputils jo \
-        jq moreutils nano pv tzdata unzip \
-        util-linux wget
-
-#hadolint ignore=DL3018
-RUN \
-    addgroup -S kah --gid 568 \
-        && adduser -S kah -G kah --uid 568 \
-    && \
-    mkdir -p /config \
-    && chown -R kah:kah /config \
-    && chmod -R 775 /config \
-    && printf "/bin/bash /scripts/greeting.sh\n" > /etc/profile.d/greeting.sh \
-    && printf "umask %d\n" "${UMASK}" > /etc/profile.d/umask.sh \
-    && ln -s /usr/bin/vi   /usr/local/bin/vi \
-    && ln -s /usr/bin/vi   /usr/local/bin/vim \
-    && ln -s /usr/bin/nano /usr/local/bin/nano \
-    && ln -s /usr/bin/nano /usr/local/bin/neovim \
-    && ln -s /usr/bin/nano /usr/local/bin/emacs \
-    && ln -s /usr/bin/catatonit /sbin/tini \
-    && rm -rf /tmp/*
-
-VOLUME ["/config"]
-COPY ./apps/alpine/scripts /scripts
-COPY --from=builder /go/bin/envsubst /usr/local/bin/envsubst
-ENTRYPOINT ["/usr/bin/catatonit", "--"]
diff --git a/apps/alpine/ci/goss.yaml b/apps/alpine/ci/goss.yaml
deleted file mode 100644
index e497134c0..000000000
--- a/apps/alpine/ci/goss.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
----
-# https://github.com/aelsabbahy/goss/blob/master/docs/manual.md#file
-file:
-  /scripts/greeting.sh:
-    exists: true
-  /scripts/umask.sh:
-    exists: true
-  /scripts/vpn.sh:
-    exists: true
-  /usr/local/bin/envsubst:
-    exists: true
-
-# https://github.com/aelsabbahy/goss/blob/master/docs/manual.md#group
-group:
-  kah:
-    exists: true
-    gid: 568
-
-# https://github.com/aelsabbahy/goss/blob/master/docs/manual.md#user
-user:
-  kah:
-    exists: true
-    uid: 568
-    gid: 568
diff --git a/apps/alpine/ci/latest.sh b/apps/alpine/ci/latest.sh
deleted file mode 100755
index 2f5e551c8..000000000
--- a/apps/alpine/ci/latest.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-channel=$1
-version=$(curl -s "https://registry.hub.docker.com/v2/repositories/library/alpine/tags?ordering=name&name=$channel" | jq --raw-output --arg s "$channel" '.results[] | select(.name | contains($s)) | .name' 2>/dev/null | head -n1)
-version="${version#*v}"
-version="${version#*release-}"
-version="${version%_*}"
-printf "%s" "${version}"
diff --git a/apps/alpine/metadata.yaml b/apps/alpine/metadata.yaml
deleted file mode 100644
index a85498886..000000000
--- a/apps/alpine/metadata.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-app: alpine
-base: true
-channels:
-  - name: "3.19"
-    platforms: ["linux/amd64", "linux/arm64"]
-    stable: true
-    tests:
-      enabled: true
-      type: cli
diff --git a/apps/alpine/scripts/greeting.sh b/apps/alpine/scripts/greeting.sh
deleted file mode 100755
index 0d220e37e..000000000
--- a/apps/alpine/scripts/greeting.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-
-echo "
-You are entering the vicinity of an area adjacent to a location.
-The kind of place where there might be a monster, or some kind of weird mirror.
-These are just examples; it could also be something much better.
-"
diff --git a/apps/alpine/scripts/sleep.sh b/apps/alpine/scripts/sleep.sh
deleted file mode 100755
index 63e423595..000000000
--- a/apps/alpine/scripts/sleep.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-
-min_seconds="${1:-1}"
-max_seconds="${2:-3600}"
-seconds="$(shuf -i "${min_seconds}"-"${max_seconds}" -n 1)"
-
-function logz {
-    msg="${1}"
-    level="${2:-info}"
-    printf "\e[1;32m%-6s\e[m\n" "timestamp=\"$(date +"%Y-%m-%dT%H:%M:%S%z")\" level=\"${level}\" msg=\"${msg}\""
-}
-
-function datez {
-    secs="${1}"
-    printf "%dh%dm%ds" $((secs/3600)) $((secs%3600/60)) $((secs%60))
-}
-
-printf "\e[1;32m%-6s\e[m\n" "$(logz "min seconds set to ${min_seconds}" "debug")"
-printf "\e[1;32m%-6s\e[m\n" "$(logz "max seconds set to ${max_seconds}" "debug")"
-
-printf "\e[1;32m%-6s\e[m\n" "$(logz "sleeping for $(datez "${seconds}")" "info")"
-
-for ((i=seconds;i>0;i--)); do 
-    printf "\e[1;32m%-6s\e[m\n" "$(logz "sleeping for $(datez "${i}")" "info")"
-    sleep 1
-done
-
-printf "\e[1;32m%-6s\e[m\n" "$(logz "done" "debug")"
diff --git a/apps/alpine/scripts/umask.sh b/apps/alpine/scripts/umask.sh
deleted file mode 100755
index bea3cc353..000000000
--- a/apps/alpine/scripts/umask.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-umask "${UMASK:-0002}"
diff --git a/apps/alpine/scripts/vpn.sh b/apps/alpine/scripts/vpn.sh
deleted file mode 100755
index 936ed5096..000000000
--- a/apps/alpine/scripts/vpn.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-if [[ "${WAIT_FOR_VPN:-"false"}" == "true" ]]; then
-    echo "Waiting for VPN to be connected..."
-    while ! grep -s -q "connected" /shared/vpnstatus; do
-        echo "VPN not connected"
-        sleep 2
-    done
-    echo "VPN Connected, starting application..."
-fi
diff --git a/apps/bazarr/Dockerfile b/apps/bazarr/Dockerfile
index 02dc2107f..80ea2ea69 100644
--- a/apps/bazarr/Dockerfile
+++ b/apps/bazarr/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+FROM docker.io/library/alpine:3.19
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -13,34 +13,52 @@ ENV \
     PIP_BREAK_SYSTEM_PACKAGES=1 \
     CRYPTOGRAPHY_DONT_BUILD_RUST=1
 
-RUN \
-    curl -fsSL -o /tmp/app.zip "https://github.com/morpheus65535/bazarr/releases/download/v${VERSION}/bazarr.zip" \
-    && unzip -q /tmp/app.zip -d /app \
-    && chown -R root:root /app \
-    && chmod -R 755 /app \
-    && rm -rf /tmp/*
+USER root
+WORKDIR /app
 
 #hadolint ignore=DL3018,DL3013
 RUN \
-    apk add --no-cache ca-certificates ffmpeg mediainfo python3 py3-lxml py3-numpy py3-gevent py3-cryptography py3-setuptools py3-psycopg2 py3-pillow unzip \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        curl \
+        ffmpeg \
+        jq \
+        mediainfo \
+        nano \
+        py3-cryptography \
+        py3-gevent \
+        py3-lxml \
+        py3-numpy \
+        py3-pillow \
+        py3-psycopg2 \
+        py3-setuptools \
+        python3 \
+        tzdata \
+        unzip \
     && \
-    apk add --no-cache --virtual .build-deps py3-pip gcc python3-dev musl-dev \
+    apk add --no-cache --virtual .build-deps \
+        py3-pip \
+        gcc \
+        python3-dev \
+        musl-dev \
     && \
-    pip install --upgrade pip \
+    pip install --upgrade "webrtcvad-wheels>=2.0.10" \
     && \
-    pip install --upgrade \
-      "webrtcvad-wheels>=2.0.10" \
+    curl -fsSL -o /tmp/app.zip "https://github.com/morpheus65535/bazarr/releases/download/v${VERSION}/bazarr.zip" \
+    && unzip -q /tmp/app.zip -d /app \
+    && chown -R root:root /app \
+    && chmod -R 755 /app \
     && apk del --purge .build-deps \
     && rm -rf \
         /root/.cache \
         /root/.cargo \
         /tmp/*
 
-# Install unrar
-COPY --from=ghcr.io/linuxserver/unrar:7.0.7 /usr/bin/unrar-alpine /usr/bin/unrar
-
-USER kah
 COPY ./apps/bazarr/entrypoint.sh /entrypoint.sh
+COPY --from=ghcr.io/linuxserver/unrar:7.0.7 /usr/bin/unrar-alpine /usr/bin/unrar
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/morpheus65535/bazarr"
diff --git a/apps/bazarr/metadata.yaml b/apps/bazarr/metadata.yaml
index a47c1cdb0..3b19a5c2f 100644
--- a/apps/bazarr/metadata.yaml
+++ b/apps/bazarr/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: bazarr
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/home-assistant/Dockerfile b/apps/home-assistant/Dockerfile
index a643830f1..0303d7866 100644
--- a/apps/home-assistant/Dockerfile
+++ b/apps/home-assistant/Dockerfile
@@ -1,20 +1,3 @@
-ARG VERSION
-FROM docker.io/library/golang:1.22-alpine as builder
-ARG VERSION
-ARG TARGETOS
-ARG TARGETARCH
-ARG TARGETVARIANT=""
-ARG TARGETPLATFORM
-ENV CGO_ENABLED=0 \
-    GOOS=${TARGETOS} \
-    GOARCH=${TARGETARCH} \
-    GOARM=${TARGETVARIANT}
-#hadolint ignore=DL3018
-RUN \
-    apk add --no-cache upx \
-    && go install -ldflags="-s -w" github.com/drone/envsubst/cmd/envsubst@latest \
-    && upx /go/bin/envsubst
-
 FROM docker.io/library/python:3.12-alpine
 
 ARG TARGETPLATFORM
@@ -29,32 +12,28 @@ ENV \
     PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PIP_BREAK_SYSTEM_PACKAGES=1 \
     HOMEASSISTANT_WHEELS="https://wheels.home-assistant.io/musllinux/" \
-    PYTHONPATH="${PYTHONPATH}:/pip-packages" \
     HOME="/config"
 
 ENV UMASK="0002" \
     TZ="Etc/UTC"
 
-WORKDIR /tmp
+USER root
+WORKDIR /app
 
 #hadolint ignore=DL3018,DL3013,DL3059,DL4006
 RUN \
     apk add --no-cache \
         bash \
-        bind-tools \
         bluez \
         bluez-deprecated \
         bluez-libs \
         ca-certificates \
         catatonit \
-        coreutils \
         cups-libs \
         curl \
         eudev-libs \
         ffmpeg \
         git \
-        iputils \
-        jo \
         jq \
         libcap \
         libturbojpeg \
@@ -62,7 +41,6 @@ RUN \
         libxslt \
         mariadb-connector-c \
         mariadb-connector-c-dev \
-        moreutils \
         nano \
         openssh-client \
         openssl \
@@ -71,8 +49,6 @@ RUN \
         tiff \
         tzdata \
         unzip \
-        util-linux \
-        wget \
     && \
     apk add --no-cache --virtual=.build-deps \
         autoconf \
@@ -110,26 +86,11 @@ RUN \
         --requirement "https://raw.githubusercontent.com/home-assistant/docker/${HOME_ASSISTANT_BASE}/requirements.txt" \
     && \
     uv pip install --system --only-binary=:all: --find-links "${HOMEASSISTANT_WHEELS}" \
-        --requirement requirements_all.txt \
+        --requirement /tmp/requirements_all.txt \
     && \
     uv pip install --system --only-binary=:all: --find-links "${HOMEASSISTANT_WHEELS}" \
         homeassistant=="${VERSION}" \
     && \
-    addgroup -S kah --gid 568 \
-        && adduser -S kah -G kah --uid 568 \
-    && \
-    mkdir -p /config \
-    && chown -R kah:kah /config \
-    && chmod -R 775 /config \
-    && printf "/bin/bash /scripts/greeting.sh\n" > /etc/profile.d/greeting.sh \
-    && printf "umask %d\n" "${UMASK}" > /etc/profile.d/umask.sh \
-    && ln -s /usr/bin/vi /usr/local/bin/vi \
-    && ln -s /usr/bin/vi /usr/local/bin/vim \
-    && ln -s /usr/bin/nano /usr/local/bin/nano \
-    && ln -s /usr/bin/nano /usr/local/bin/neovim \
-    && ln -s /usr/bin/nano /usr/local/bin/emacs \
-    && ln -s /usr/bin/catatonit /sbin/tini \
-    && \
     apk del --purge .build-deps \
     && \
     rm -rf \
@@ -137,13 +98,8 @@ RUN \
         /root/.cargo \
         /tmp/*
 
-COPY --from=builder /go/bin/envsubst /usr/local/bin/envsubst
-COPY ./apps/home-assistant/scripts /scripts
-VOLUME ["/config"]
-
-WORKDIR /app
-USER kah
 COPY ./apps/home-assistant/entrypoint.sh /entrypoint.sh
+
 ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
diff --git a/apps/home-assistant/entrypoint.sh b/apps/home-assistant/entrypoint.sh
index aa4f1bb7d..218b9c37a 100755
--- a/apps/home-assistant/entrypoint.sh
+++ b/apps/home-assistant/entrypoint.sh
@@ -1,14 +1,11 @@
 #!/usr/bin/env bash
 
-#shellcheck disable=SC1091
-test -f "/scripts/umask.sh" && source "/scripts/umask.sh"
-
 # Make sure the config and log directory exist
 mkdir -p /config/logs
 
 # Install HACS if requested
 if [[ "${HOME_ASSISTANT__HACS_INSTALL}" == "true" ]]; then
-    wget -O - https://get.hacs.xyz | bash -
+    curl -sfSL https://hacs.xyz/install | bash -
 fi
 
 exec \
diff --git a/apps/home-assistant/metadata.yaml b/apps/home-assistant/metadata.yaml
index f96174c62..b7b710f2f 100644
--- a/apps/home-assistant/metadata.yaml
+++ b/apps/home-assistant/metadata.yaml
@@ -1,6 +1,5 @@
 ---
 app: home-assistant
-base: false
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/home-assistant/scripts/greeting.sh b/apps/home-assistant/scripts/greeting.sh
deleted file mode 100755
index 0d220e37e..000000000
--- a/apps/home-assistant/scripts/greeting.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-
-echo "
-You are entering the vicinity of an area adjacent to a location.
-The kind of place where there might be a monster, or some kind of weird mirror.
-These are just examples; it could also be something much better.
-"
diff --git a/apps/home-assistant/scripts/umask.sh b/apps/home-assistant/scripts/umask.sh
deleted file mode 100755
index bea3cc353..000000000
--- a/apps/home-assistant/scripts/umask.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-umask "${UMASK:-0002}"
diff --git a/apps/jbops/Dockerfile b/apps/jbops/Dockerfile
index d44c55634..753534726 100644
--- a/apps/jbops/Dockerfile
+++ b/apps/jbops/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+FROM docker.io/library/alpine:3.19
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -16,10 +16,19 @@ ENV \
 ENV PLEXAPI_CONFIG_PATH="/config/config.ini" \
     JBOPS__SCRIPT_PATH="fun/plexapi_haiku.py"
 
+USER root
+WORKDIR /app
+
 #hadolint ignore=DL3018,DL3013
 RUN apk add --no-cache \
+        bash \
         ca-certificates \
+        catatonit \
+        curl \
+        jq \
+        nano \
         python3 \
+        tzdata \
     && \
     apk add --no-cache --virtual=.build-deps \
         build-base \
@@ -30,14 +39,13 @@ RUN apk add --no-cache \
         py3-pip \
         git \
     && \
-    pip install --upgrade pip \
-    && git clone https://github.com/blacktwin/JBOPS.git . \
+    git clone https://github.com/blacktwin/JBOPS.git . \
     && if [ -n "${VERSION}" ]; then \
         NUMBER_COMMITS_TO_REVERT=$(( $(git rev-list --count --first-parent HEAD) - $(echo "${VERSION}" | cut -d "." -f3) )); \
         git checkout "master~${NUMBER_COMMITS_TO_REVERT}"; \
     fi \
     && \
-    pip install --upgrade --requirement /app/requirements.txt \
+    pip install --upgrade --requirement requirements.txt \
     && apk del --purge .build-deps \
     && chown -R root:root /app \
     && chmod -R 755 /app \
@@ -46,8 +54,8 @@ RUN apk add --no-cache \
         /root/.cargo \
         /tmp/*
 
-USER kah
 COPY ./apps/jbops/entrypoint.sh /entrypoint.sh
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/blacktwin/JBOPS"
diff --git a/apps/jbops/metadata.yaml b/apps/jbops/metadata.yaml
index e5ab735b1..4447e79ac 100644
--- a/apps/jbops/metadata.yaml
+++ b/apps/jbops/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: jbops
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/lidarr/Dockerfile b/apps/lidarr/Dockerfile
index b5031494d..12dc1716f 100644
--- a/apps/lidarr/Dockerfile
+++ b/apps/lidarr/Dockerfile
@@ -1,4 +1,17 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+ARG VERSION
+FROM docker.io/library/golang:1.22-alpine as envsubst
+ARG VERSION
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT=""
+ARG TARGETPLATFORM
+ENV CGO_ENABLED=0 \
+    GOOS=${TARGETOS} \
+    GOARCH=${TARGETARCH} \
+    GOARM=${TARGETVARIANT}
+RUN go install -ldflags="-s -w" github.com/drone/envsubst/cmd/envsubst@latest
+
+FROM docker.io/library/alpine:3.19
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -11,10 +24,26 @@ ENV \
     LIDARR__PORT="8686" \
     LIDARR__ANALYTICS_ENABLED="False"
 
-#hadolint ignore=DL3018
-RUN apk add --no-cache ca-certificates chromaprint ffmpeg icu-libs libintl sqlite-libs xmlstarlet
-#hadolint ignore=DL3059
+USER root
+WORKDIR /app
+
+#hadolint ignore=DL3018,DL3059
 RUN \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        chromaprint \
+        curl \
+        ffmpeg \
+        icu-libs \
+        jq \
+        libintl \
+        nano \
+        sqlite-libs \
+        tzdata \
+        xmlstarlet \
+    && \
     case "${TARGETPLATFORM}" in \
         'linux/amd64') export ARCH='x64' ;; \
         'linux/arm64') export ARCH='arm64' ;; \
@@ -25,19 +54,18 @@ RUN \
     curl -fsSL "https://lidarr.servarr.com/v1/update/${LIDARR__BRANCH}/updatefile?version=${VERSION}&os=linuxmusl&runtime=netcore&arch=${ARCH}" \
         | tar xzf - -C /app/bin --strip-components=1 \
     && \
-    rm -rf \
-        /app/bin/Lidarr.Update \
-        /app/bin/fpcalc \
+    rm -rf /app/bin/Lidarr.Update /app/bin/fpcalc \
     && \
     printf "UpdateMethod=docker\nBranch=%s\nPackageVersion=%s\nPackageAuthor=[onedr0p](https://github.com/onedr0p)\n" "${LIDARR__BRANCH}" "${VERSION}" > /app/package_info \
     && chown -R root:root /app \
     && chmod -R 755 /app \
     && rm -rf /tmp/*
 
-USER kah
-
 COPY ./apps/lidarr/config.xml.tmpl /app/config.xml.tmpl
 COPY ./apps/lidarr/entrypoint.sh /entrypoint.sh
+COPY --from=envsubst /go/bin/envsubst /usr/local/bin/envsubst
+
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/Lidarr/Lidarr"
diff --git a/apps/lidarr/metadata.yaml b/apps/lidarr/metadata.yaml
index 389d75126..28b3cf04a 100644
--- a/apps/lidarr/metadata.yaml
+++ b/apps/lidarr/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: lidarr
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: master
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/par2cmdline-turbo/metadata.yaml b/apps/par2cmdline-turbo/metadata.yaml
index 4a9e10d1b..c5c9ca84b 100644
--- a/apps/par2cmdline-turbo/metadata.yaml
+++ b/apps/par2cmdline-turbo/metadata.yaml
@@ -1,6 +1,5 @@
 ---
 app: par2cmdline-turbo
-base: false
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/plex/Dockerfile b/apps/plex/Dockerfile
index 89042ae89..c9f8c78ba 100644
--- a/apps/plex/Dockerfile
+++ b/apps/plex/Dockerfile
@@ -1,16 +1,3 @@
-ARG VERSION
-FROM docker.io/library/golang:1.22 as envsubst
-ARG VERSION
-ARG TARGETOS
-ARG TARGETARCH
-ARG TARGETVARIANT=""
-ARG TARGETPLATFORM
-ENV CGO_ENABLED=0 \
-    GOOS=${TARGETOS} \
-    GOARCH=${TARGETARCH} \
-    GOARM=${TARGETVARIANT}
-RUN go install -ldflags="-s -w" github.com/drone/envsubst/cmd/envsubst@latest
-
 FROM docker.io/library/ubuntu:22.04
 
 ARG TARGETPLATFORM
@@ -32,26 +19,21 @@ ENV UMASK="0002" \
     TZ="Etc/UTC"
 
 USER root
+WORKDIR /app
 
 # hadolint ignore=DL3008,DL3015,SC2039,SC2086
 RUN \
-    apt-get -qq update \
+    apt-get update \
     && \
-    apt-get -qq install --no-install-recommends --no-install-suggests -y \
+    apt-get install -y --no-install-recommends --no-install-suggests \
         bash \
         ca-certificates \
         catatonit \
-        coreutils \
         curl \
-        dnsutils \
-        iputils-ping \
-        jo \
         jq \
-        moreutils \
+        nano \
         tzdata \
-        unzip \
         uuid-runtime \
-        vim-tiny \
         xmlstarlet \
     && \
     case "${TARGETPLATFORM}" in \
@@ -78,10 +60,6 @@ RUN \
         /var/lib/apt/lists/* \
         /var/tmp/
 
-WORKDIR "${PLEX_MEDIA_SERVER_HOME}"
-
-COPY --from=envsubst /go/bin/envsubst /usr/local/bin/envsubst
-
 COPY ./apps/plex/entrypoint.sh /entrypoint.sh
 
 ENTRYPOINT [ "/usr/bin/catatonit", "--" ]
diff --git a/apps/plex/metadata.yaml b/apps/plex/metadata.yaml
index 20998bc4c..84729779a 100644
--- a/apps/plex/metadata.yaml
+++ b/apps/plex/metadata.yaml
@@ -1,6 +1,5 @@
 ---
 app: plex
-base: false
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/postgres-init/Dockerfile b/apps/postgres-init/Dockerfile
index 940364049..131fb4fcc 100644
--- a/apps/postgres-init/Dockerfile
+++ b/apps/postgres-init/Dockerfile
@@ -1,16 +1,23 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+FROM docker.io/library/alpine:3.19
 
 ARG TARGETPLATFORM
 ARG VERSION
 ARG CHANNEL
 
-#hadolint ignore=DL3018
-RUN apk add --no-cache ca-certificates postgresql16-client~"${VERSION}"
+USER root
+WORKDIR /app
 
-USER kah
+#hadolint ignore=DL3018
+RUN \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        postgresql16-client~"${VERSION}"
 
 COPY ./apps/postgres-init/entrypoint.sh /entrypoint.sh
 
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/postgres/postgres"
diff --git a/apps/postgres-init/metadata.yaml b/apps/postgres-init/metadata.yaml
index 65bc6c580..23eb75389 100644
--- a/apps/postgres-init/metadata.yaml
+++ b/apps/postgres-init/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: postgres-init
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/prowlarr/Dockerfile b/apps/prowlarr/Dockerfile
index f3ea7e528..afbac6b6b 100644
--- a/apps/prowlarr/Dockerfile
+++ b/apps/prowlarr/Dockerfile
@@ -1,4 +1,17 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+ARG VERSION
+FROM docker.io/library/golang:1.22-alpine as envsubst
+ARG VERSION
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT=""
+ARG TARGETPLATFORM
+ENV CGO_ENABLED=0 \
+    GOOS=${TARGETOS} \
+    GOARCH=${TARGETARCH} \
+    GOARM=${TARGETVARIANT}
+RUN go install -ldflags="-s -w" github.com/drone/envsubst/cmd/envsubst@latest
+
+FROM docker.io/library/alpine:3.19
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -11,10 +24,24 @@ ENV \
     PROWLARR__PORT="9696" \
     PROWLARR__ANALYTICS_ENABLED="False"
 
-#hadolint ignore=DL3018
-RUN apk add --no-cache ca-certificates icu-libs libintl sqlite-libs xmlstarlet
-#hadolint ignore=DL3059
+USER root
+WORKDIR /app
+
+#hadolint ignore=DL3018,DL3059
 RUN \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        curl \
+        icu-libs \
+        jq \
+        libintl \
+        nano \
+        sqlite-libs \
+        tzdata \
+        xmlstarlet \
+    && \
     case "${TARGETPLATFORM}" in \
         'linux/amd64') export ARCH='x64' ;; \
         'linux/arm64') export ARCH='arm64' ;; \
@@ -25,17 +52,18 @@ RUN \
     curl -fsSL "https://prowlarr.servarr.com/v1/update/${PROWLARR__BRANCH}/updatefile?version=${VERSION}&os=linuxmusl&runtime=netcore&arch=${ARCH}" \
         | tar xzf - -C /app/bin --strip-components=1 \
     && \
-    rm -rf \
-        /app/bin/Prowlarr.Update \
+    rm -rf /app/bin/Prowlarr.Update \
     && \
     printf "UpdateMethod=docker\nBranch=%s\nPackageVersion=%s\nPackageAuthor=[onedr0p](https://github.com/onedr0p)\n" "${PROWLARR__BRANCH}" "${VERSION}" > /app/package_info \
     && chown -R root:root /app \
     && chmod -R 755 /app \
     && rm -rf /tmp/*
 
-USER kah
 COPY ./apps/prowlarr/config.xml.tmpl /app/config.xml.tmpl
 COPY ./apps/prowlarr/entrypoint.sh /entrypoint.sh
+COPY --from=envsubst /go/bin/envsubst /usr/local/bin/envsubst
+
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/Prowlarr/Prowlarr"
diff --git a/apps/prowlarr/metadata.yaml b/apps/prowlarr/metadata.yaml
index 7e9133c64..e41e8fde8 100644
--- a/apps/prowlarr/metadata.yaml
+++ b/apps/prowlarr/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: prowlarr
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: master
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/qbittorrent/Dockerfile b/apps/qbittorrent/Dockerfile
index 4fe91b3e3..b351cb5fa 100644
--- a/apps/qbittorrent/Dockerfile
+++ b/apps/qbittorrent/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+FROM docker.io/library/alpine:3.19
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -7,17 +7,30 @@ ARG CHANNEL
 ENV QBITTORRENT__PORT=8080 \
     QBITTORRENT__BT_PORT=50413
 
-#hadolint ignore=DL3018
-RUN \
-    apk add --no-cache ca-certificates geoip p7zip python3 \
-    && apk add --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/edge/community qt6-qtbase-sqlite
+USER root
+WORKDIR /app
 
+#hadolint ignore=DL3018,DL3059
 RUN \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        curl \
+        geoip \
+        jq \
+        nano \
+        p7zip \
+        python3 \
+        tzdata \
+    && \
     case "${TARGETPLATFORM}" in \
         'linux/amd64') export ARCH="x86_64" ;; \
         'linux/arm64') export ARCH="aarch64" ;; \
     esac \
     && \
+    mkdir -p /app \
+    && \
     case "${CHANNEL}" in \
         'stable') \
             export RELEASE=$(curl -sL "https://github.com/userdocs/qbittorrent-nox-static/releases/latest/download/dependency-version.json" | jq -r '. | "release-\(.qbittorrent)_v\(.libtorrent_1_2)"') \
@@ -33,11 +46,10 @@ RUN \
     && chmod -R 755 /app/qbittorrent-nox \
     && rm -rf /tmp/*
 
-USER kah
-
-COPY ./apps/qbittorrent/config.py /scripts/config.py
+COPY ./apps/qbittorrent/scripts/config.py /scripts/config.py
 COPY ./apps/qbittorrent/entrypoint.sh /entrypoint.sh
 
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/qbittorrent/qBittorrent"
diff --git a/apps/qbittorrent/entrypoint.sh b/apps/qbittorrent/entrypoint.sh
index cbbd5108b..6cc81179a 100755
--- a/apps/qbittorrent/entrypoint.sh
+++ b/apps/qbittorrent/entrypoint.sh
@@ -1,9 +1,5 @@
 #!/usr/bin/env bash
 
-#shellcheck disable=SC1091
-test -f "/scripts/umask.sh" && source "/scripts/umask.sh"
-test -f "/scripts/vpn.sh" && source "/scripts/vpn.sh"
-
 downloadsPath="/downloads"
 
 if [[ -z "$QBITTORRENT__USE_PROFILE" ]]; then
diff --git a/apps/qbittorrent/metadata.yaml b/apps/qbittorrent/metadata.yaml
index 9777b658b..de2ac83de 100644
--- a/apps/qbittorrent/metadata.yaml
+++ b/apps/qbittorrent/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: qbittorrent
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/qbittorrent/config.py b/apps/qbittorrent/scripts/config.py
similarity index 100%
rename from apps/qbittorrent/config.py
rename to apps/qbittorrent/scripts/config.py
diff --git a/apps/radarr/Dockerfile b/apps/radarr/Dockerfile
index f5669e749..04a65ea82 100644
--- a/apps/radarr/Dockerfile
+++ b/apps/radarr/Dockerfile
@@ -1,4 +1,17 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+ARG VERSION
+FROM docker.io/library/golang:1.22-alpine as envsubst
+ARG VERSION
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT=""
+ARG TARGETPLATFORM
+ENV CGO_ENABLED=0 \
+    GOOS=${TARGETOS} \
+    GOARCH=${TARGETARCH} \
+    GOARM=${TARGETVARIANT}
+RUN go install -ldflags="-s -w" github.com/drone/envsubst/cmd/envsubst@latest
+
+FROM docker.io/library/alpine:3.19
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -11,10 +24,24 @@ ENV \
     RADARR__PORT="7878" \
     RADARR__ANALYTICS_ENABLED="False"
 
-#hadolint ignore=DL3018
-RUN apk add --no-cache ca-certificates icu-libs libintl sqlite-libs xmlstarlet
-#hadolint ignore=DL3059
+USER root
+WORKDIR /app
+
+#hadolint ignore=DL3018,DL3059
 RUN \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        curl \
+        icu-libs \
+        jq \
+        libintl \
+        nano \
+        sqlite-libs \
+        tzdata \
+        xmlstarlet \
+    && \
     case "${TARGETPLATFORM}" in \
         'linux/amd64') export ARCH='x64' ;; \
         'linux/arm64') export ARCH='arm64' ;; \
@@ -25,18 +52,18 @@ RUN \
     curl -fsSL "https://radarr.servarr.com/v1/update/${RADARR__BRANCH}/updatefile?version=${VERSION}&os=linuxmusl&runtime=netcore&arch=${ARCH}" \
         | tar xzf - -C /app/bin --strip-components=1 \
     && \
-    rm -rf \
-        /app/bin/Radarr.Update \
+    rm -rf /app/bin/Radarr.Update \
     && \
     printf "UpdateMethod=docker\nBranch=%s\nPackageVersion=%s\nPackageAuthor=[onedr0p](https://github.com/onedr0p)\n" "${RADARR__BRANCH}" "${VERSION}" > /app/package_info \
     && chown -R root:root /app \
     && chmod -R 755 /app \
     && rm -rf /tmp/*
 
-USER kah
-
 COPY ./apps/radarr/config.xml.tmpl /app/config.xml.tmpl
 COPY ./apps/radarr/entrypoint.sh /entrypoint.sh
+COPY --from=envsubst /go/bin/envsubst /usr/local/bin/envsubst
+
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/Radarr/Radarr"
diff --git a/apps/radarr/metadata.yaml b/apps/radarr/metadata.yaml
index 1329a802f..fb0c116a2 100644
--- a/apps/radarr/metadata.yaml
+++ b/apps/radarr/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: radarr
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: master
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/readarr/Dockerfile b/apps/readarr/Dockerfile
index 394341e30..38b37aaf2 100644
--- a/apps/readarr/Dockerfile
+++ b/apps/readarr/Dockerfile
@@ -1,4 +1,17 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+ARG VERSION
+FROM docker.io/library/golang:1.22-alpine as envsubst
+ARG VERSION
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT=""
+ARG TARGETPLATFORM
+ENV CGO_ENABLED=0 \
+    GOOS=${TARGETOS} \
+    GOARCH=${TARGETARCH} \
+    GOARM=${TARGETVARIANT}
+RUN go install -ldflags="-s -w" github.com/drone/envsubst/cmd/envsubst@latest
+
+FROM docker.io/library/alpine:3.19
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -10,10 +23,24 @@ ENV \
     READARR__PORT="8787" \
     READARR__ANALYTICS_ENABLED="False"
 
-#hadolint ignore=DL3018
-RUN apk add --no-cache ca-certificates icu-libs libintl sqlite-libs xmlstarlet
-#hadolint ignore=DL3059
+USER root
+WORKDIR /app
+
+#hadolint ignore=DL3018,DL3059
 RUN \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        curl \
+        icu-libs \
+        jq \
+        libintl \
+        nano \
+        sqlite-libs \
+        tzdata \
+        xmlstarlet \
+    && \
     case "${TARGETPLATFORM}" in \
         'linux/amd64') export ARCH='x64' ;; \
         'linux/arm64') export ARCH='arm64' ;; \
@@ -24,18 +51,18 @@ RUN \
     curl -fsSL "https://readarr.servarr.com/v1/update/${READARR__BRANCH}/updatefile?version=${VERSION}&os=linuxmusl&runtime=netcore&arch=${ARCH}" \
         | tar xzf - -C /app/bin --strip-components=1 \
     && \
-    rm -rf \
-        /app/bin/Readarr.Update \
+    rm -rf /app/bin/Readarr.Update \
     && \
     printf "UpdateMethod=docker\nBranch=%s\nPackageVersion=%s\nPackageAuthor=[onedr0p](https://github.com/onedr0p)\n" "${READARR__BRANCH}" "${VERSION}" > /app/package_info \
     && chown -R root:root /app \
     && chmod -R 755 /app \
     && rm -rf /tmp/*
 
-USER kah
-
 COPY ./apps/readarr/config.xml.tmpl /app/config.xml.tmpl
 COPY ./apps/readarr/entrypoint.sh /entrypoint.sh
+COPY --from=envsubst /go/bin/envsubst /usr/local/bin/envsubst
+
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/Readarr/Readarr"
diff --git a/apps/readarr/metadata.yaml b/apps/readarr/metadata.yaml
index 9919dcdf1..d45f5ba5d 100644
--- a/apps/readarr/metadata.yaml
+++ b/apps/readarr/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: readarr
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: develop
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/sabnzbd/Dockerfile b/apps/sabnzbd/Dockerfile
index 2189003c8..244414300 100644
--- a/apps/sabnzbd/Dockerfile
+++ b/apps/sabnzbd/Dockerfile
@@ -1,4 +1,5 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+FROM docker.io/library/python:3.12-alpine
+
 ARG TARGETPLATFORM
 ARG VERSION
 ARG CHANNEL
@@ -14,54 +15,53 @@ ENV \
 
 ENV SABNZBD__PORT=8080
 
-# Download source
-RUN \
-    curl -fsSL "https://github.com/sabnzbd/sabnzbd/releases/download/${VERSION}/SABnzbd-${VERSION}-src.tar.gz" \
-        | tar xzf - -C /app --strip-components=1 \
-    && \
-    chown -R root:root /app \
-    && chmod -R 755 /app \
-    && rm -rf /tmp/*
+USER root
+WORKDIR /app
 
-# Install sabnzbd
 RUN \
-    # Keep py3-pip installed
-    \
     apk add --no-cache \
+        bash \
         ca-certificates \
-        python3 \
-        py3-pip \
+        catatonit \
+        curl \
+        jq \
+        nano \
         p7zip \
+        tzdata \
     && \
     apk add --no-cache --virtual=.build-deps \
         build-base \
+        cargo \
         libffi-dev \
-        openssl-dev \
         musl-dev \
-        cargo \
-        python3-dev \
+        openssl-dev \
     && \
-    pip install --upgrade pip \
+    mkdir -p /app \
     && \
-    pip install --upgrade --requirement /app/requirements.txt \
+    curl -fsSL "https://github.com/sabnzbd/sabnzbd/releases/download/${VERSION}/SABnzbd-${VERSION}-src.tar.gz" \
+        | tar xzf - -C /app --strip-components=1 \
+    && \
+    pip install uv \
+    && \
+    uv pip install --system --requirement /app/requirements.txt \
+    && \
+    chown -R root:root /app \
+    && chmod -R 755 /app \
     && apk del --purge .build-deps \
     && rm -rf \
         /root/.cache \
         /root/.cargo \
         /tmp/*
 
-# Install par2cmdline-turbo
+COPY ./apps/sabnzbd/sabnzbd.ini /app/sabnzbd.ini
+COPY ./apps/sabnzbd/entrypoint.sh /entrypoint.sh
 COPY --from=ghcr.io/onedr0p/par2cmdline-turbo:1.1.1 /usr/local/bin/par2 /usr/local/bin/par2
 RUN ln -s /usr/local/bin/par2 /usr/local/bin/par2create \
     && ln -s /usr/local/bin/par2 /usr/local/bin/par2repair \
     && ln -s /usr/local/bin/par2 /usr/local/bin/par2verify
-
-# Install unrar
 COPY --from=ghcr.io/linuxserver/unrar:7.0.7 /usr/bin/unrar-alpine /usr/bin/unrar
 
-USER kah
-COPY ./apps/sabnzbd/sabnzbd.ini /app/sabnzbd.ini
-COPY ./apps/sabnzbd/entrypoint.sh /entrypoint.sh
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/sabnzbd/sabnzbd"
diff --git a/apps/sabnzbd/ci/goss.yaml b/apps/sabnzbd/ci/goss.yaml
index fbc074084..ad77641f6 100644
--- a/apps/sabnzbd/ci/goss.yaml
+++ b/apps/sabnzbd/ci/goss.yaml
@@ -1,7 +1,7 @@
 ---
 # https://github.com/aelsabbahy/goss/blob/master/docs/manual.md#process
 process:
-  python3:
+  python:
     running: true
 
 # https://github.com/aelsabbahy/goss/blob/master/docs/manual.md#port
diff --git a/apps/sabnzbd/entrypoint.sh b/apps/sabnzbd/entrypoint.sh
index d52e6de7c..53a9d6a99 100755
--- a/apps/sabnzbd/entrypoint.sh
+++ b/apps/sabnzbd/entrypoint.sh
@@ -1,9 +1,5 @@
 #!/usr/bin/env bash
 
-#shellcheck disable=SC1091
-test -f "/scripts/umask.sh" && source "/scripts/umask.sh"
-test -f "/scripts/vpn.sh" && source "/scripts/vpn.sh"
-
 if [[ ! -f "/config/sabnzbd.ini" ]]; then
     printf "Copying over default configuration ...\n"
     mkdir -p /config/sabnzbd
@@ -22,7 +18,7 @@ fi
 
 #shellcheck disable=SC2086
 exec \
-    /usr/bin/python3 \
+    python \
         /app/SABnzbd.py \
         --browser 0 \
         --server 0.0.0.0:${SABNZBD__PORT:-8080} \
diff --git a/apps/sabnzbd/metadata.yaml b/apps/sabnzbd/metadata.yaml
index 3be72aadc..4d56ba337 100644
--- a/apps/sabnzbd/metadata.yaml
+++ b/apps/sabnzbd/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: sabnzbd
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/sonarr/Dockerfile b/apps/sonarr/Dockerfile
index 9589cd795..48abdaba4 100644
--- a/apps/sonarr/Dockerfile
+++ b/apps/sonarr/Dockerfile
@@ -1,4 +1,17 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+ARG VERSION
+FROM docker.io/library/golang:1.22-alpine as envsubst
+ARG VERSION
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT=""
+ARG TARGETPLATFORM
+ENV CGO_ENABLED=0 \
+    GOOS=${TARGETOS} \
+    GOARCH=${TARGETARCH} \
+    GOARM=${TARGETVARIANT}
+RUN go install -ldflags="-s -w" github.com/drone/envsubst/cmd/envsubst@latest
+
+FROM docker.io/library/alpine:3.19
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -11,10 +24,24 @@ ENV \
     SONARR__PORT="8989" \
     SONARR__ANALYTICS_ENABLED="False"
 
-#hadolint ignore=DL3018
-RUN apk add --no-cache ca-certificates icu-libs libintl sqlite-libs xmlstarlet
-#hadolint ignore=DL3059
+USER root
+WORKDIR /app
+
+#hadolint ignore=DL3018,DL3059
 RUN \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        curl \
+        icu-libs \
+        jq \
+        libintl \
+        nano \
+        sqlite-libs \
+        tzdata \
+        xmlstarlet \
+    && \
     case "${TARGETPLATFORM}" in \
         'linux/amd64') export ARCH='x64' ;; \
         'linux/arm64') export ARCH='arm64' ;; \
@@ -25,18 +52,18 @@ RUN \
     curl -fsSL "https://services.sonarr.tv/v1/update/${SONARR__BRANCH}/download?version=${VERSION}&os=linuxmusl&runtime=netcore&arch=${ARCH}" \
         | tar xzf - -C /app/bin --strip-components=1 \
     && \
-    rm -rf \
-        /app/bin/Sonarr.Update \
+    rm -rf /app/bin/Sonarr.Update \
     && \
     printf "UpdateMethod=docker\nBranch=%s\nPackageVersion=%s\nPackageAuthor=[onedr0p](https://github.com/onedr0p)\n" "${SONARR__BRANCH}" "${VERSION}" > /app/package_info \
     && chown -R root:root /app \
     && chmod -R 755 /app \
     && rm -rf /tmp/*
 
-USER kah
-
 COPY ./apps/sonarr/config.xml.tmpl /app/config.xml.tmpl
 COPY ./apps/sonarr/entrypoint.sh /entrypoint.sh
+COPY --from=envsubst /go/bin/envsubst /usr/local/bin/envsubst
+
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
-LABEL org.opencontainers.image.title="${SONARR__INSTANCE_NAME} (${SONARR__BRANCH})"
+LABEL org.opencontainers.image.source="https://github.com/Sonarr/Sonarr"
diff --git a/apps/sonarr/metadata.yaml b/apps/sonarr/metadata.yaml
index 93bd60b0c..e277e6356 100644
--- a/apps/sonarr/metadata.yaml
+++ b/apps/sonarr/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: sonarr
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: main
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/tautulli/Dockerfile b/apps/tautulli/Dockerfile
index a21b232b7..f9d5478c0 100644
--- a/apps/tautulli/Dockerfile
+++ b/apps/tautulli/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/onedr0p/alpine:rolling@sha256:3fbc581cb0fe29830376161ae026e2a765dcc11e1747477fe9ebf155720b8638
+FROM docker.io/library/python:3.11-alpine
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -15,7 +15,34 @@ ENV \
 
 ENV TAUTULLI_DOCKER="True"
 
+USER root
+WORKDIR /app
+
+#hadolint ignore=DL3018,DL3013
 RUN \
+    apk add --no-cache \
+        bash \
+        ca-certificates \
+        catatonit \
+        curl \
+        jq \
+        nano \
+        tzdata \
+    && \
+    apk add --no-cache --virtual .build-deps \
+        build-base \
+        cargo \
+        libffi-dev \
+        musl-dev \
+        openssl-dev \
+    && \
+    pip install uv \
+    && \
+    uv pip install --system \
+        --requirement "https://raw.githubusercontent.com/Tautulli/tautulli-baseimage/python3/requirements.txt" \
+    && \
+    mkdir -p /app \
+    && \
     curl -fsSL "https://github.com/Tautulli/Tautulli/archive/v${VERSION}.tar.gz" | tar xzf - -C /app --strip-components 1 \
     && \
     echo "v${VERSION}" > /app/version.txt \
@@ -23,27 +50,15 @@ RUN \
     echo "${CHANNEL}" > /app/branch.txt \
     && chown -R root:root /app \
     && chmod -R 755 /app \
-    && rm -rf /tmp/*
-
-#hadolint ignore=DL3018,DL3013
-RUN \
-    apk add --no-cache ca-certificates python3 py3-lxml py3-openssl py3-setuptools \
-    && \
-    apk add --no-cache --virtual .build-deps py3-pip make gcc g++ python3-dev \
-    && \
-    pip install --upgrade pip \
-    && \
-    pip install --upgrade \
-        plexapi \
-        pycryptodomex \
     && apk del --purge .build-deps \
     && rm -rf \
         /root/.cache \
         /root/.cargo \
         /tmp/*
 
-USER kah
 COPY ./apps/tautulli/entrypoint.sh /entrypoint.sh
+
+ENTRYPOINT ["/usr/bin/catatonit", "--"]
 CMD ["/entrypoint.sh"]
 
 LABEL org.opencontainers.image.source="https://github.com/Tautulli/Tautulli"
diff --git a/apps/tautulli/ci/goss.yaml b/apps/tautulli/ci/goss.yaml
index c35d06cc0..a328432f9 100644
--- a/apps/tautulli/ci/goss.yaml
+++ b/apps/tautulli/ci/goss.yaml
@@ -1,7 +1,7 @@
 ---
 # https://github.com/aelsabbahy/goss/blob/master/docs/manual.md#process
 process:
-  python3:
+  python:
     running: true
 
 # https://github.com/aelsabbahy/goss/blob/master/docs/manual.md#port
diff --git a/apps/tautulli/entrypoint.sh b/apps/tautulli/entrypoint.sh
index ecabf8fbf..e3b7007b4 100755
--- a/apps/tautulli/entrypoint.sh
+++ b/apps/tautulli/entrypoint.sh
@@ -5,7 +5,7 @@ test -f "/scripts/umask.sh" && source "/scripts/umask.sh"
 
 #shellcheck disable=SC2086
 exec \
-    /usr/bin/python3 \
+    python \
         /app/Tautulli.py \
         --nolaunch \
         --config /config/config.ini \
diff --git a/apps/tautulli/metadata.yaml b/apps/tautulli/metadata.yaml
index 3d9b67de3..9164babc9 100644
--- a/apps/tautulli/metadata.yaml
+++ b/apps/tautulli/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: tautulli
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: master
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/theme-park/Dockerfile b/apps/theme-park/Dockerfile
index 0e834a1f5..5e8bc59af 100644
--- a/apps/theme-park/Dockerfile
+++ b/apps/theme-park/Dockerfile
@@ -1,4 +1,4 @@
-FROM nginxinc/nginx-unprivileged:1.25.4
+FROM docker.io/nginxinc/nginx-unprivileged:1.25.4
 
 ARG TARGETPLATFORM
 ARG VERSION
@@ -9,9 +9,9 @@ ENV NGINX_WEB_ROOT "/usr/share/nginx/html"
 
 #hadolint ignore=DL3008
 RUN \
-    apt-get update -qq \
+    apt-get update \
     && \
-    apt-get install -qqy --no-install-recommends --no-install-suggests python3 \
+    apt-get install -y --no-install-recommends --no-install-suggests python3 \
     && \
     curl -fsSL "https://github.com/themepark-dev/theme.park/archive/${VERSION}.tar.gz" \
       | tar xzf - -C /tmp --strip-components 1 \
diff --git a/apps/theme-park/metadata.yaml b/apps/theme-park/metadata.yaml
index 62ce33d2c..738f28785 100644
--- a/apps/theme-park/metadata.yaml
+++ b/apps/theme-park/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: theme-park
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/apps/volsync/Dockerfile b/apps/volsync/Dockerfile
index e5ef2bf44..f958d2955 100644
--- a/apps/volsync/Dockerfile
+++ b/apps/volsync/Dockerfile
@@ -1,22 +1,15 @@
 ARG VERSION
-FROM docker.io/library/alpine:3.19 as builder
+FROM docker.io/library/golang:1.22-alpine as volsync
 ARG VERSION
 ARG TARGETOS
 ARG TARGETARCH
 ARG TARGETVARIANT=""
 ARG TARGETPLATFORM
-ENV GO111MODULE=on \
-    CGO_ENABLED=0 \
+ENV CGO_ENABLED=0 \
     GOOS=${TARGETOS} \
     GOARCH=${TARGETARCH} \
-    GOARM=${TARGETVARIANT} \
-    GOPATH=/go
-ENV PATH $GOPATH/bin:$PATH
-#hadolint ignore=DL3018
-RUN \
-    apk add --no-cache git go upx \
-    && go install -a -ldflags "-X=main.volsyncVersion=v${VERSION}" github.com/backube/volsync@v${VERSION} \
-    && upx /go/bin/volsync
+    GOARM=${TARGETVARIANT}
+RUN go install -a -ldflags "-X=main.volsyncVersion=v${VERSION}" github.com/backube/volsync@v${VERSION}
 
 FROM docker.io/library/alpine:3.19.1
 ARG TARGETPLATFORM
@@ -42,8 +35,8 @@ RUN \
     && rm -rf /tmp/*
 
 COPY --from=docker.io/rclone/rclone:1.66.0 /usr/local/bin/rclone /usr/local/bin/rclone
-COPY --from=docker.io/restic/restic:0.16.4 /usr/bin/restic       /usr/local/bin/restic
-COPY --from=builder /go/bin/volsync /manager
+COPY --from=docker.io/restic/restic:0.16.4 /usr/bin/restic /usr/local/bin/restic
+COPY --from=volsync /go/bin/volsync /manager
 
 ENTRYPOINT ["/bin/bash"]
 
diff --git a/apps/volsync/metadata.yaml b/apps/volsync/metadata.yaml
index 728b52bbe..65ca7de5a 100644
--- a/apps/volsync/metadata.yaml
+++ b/apps/volsync/metadata.yaml
@@ -1,7 +1,6 @@
 ---
 app: volsync
-base: false
-semantic_versioning: true
+semver: true
 channels:
   - name: stable
     platforms: ["linux/amd64", "linux/arm64"]
diff --git a/metadata.rules.cue b/metadata.rules.cue
index 271416af2..486522607 100644
--- a/metadata.rules.cue
+++ b/metadata.rules.cue
@@ -1,7 +1,6 @@
 #Spec: {
     app:  #AcceptableAppName
-    base: bool
-    semantic_versioning?: bool
+    semver?: bool
     channels: [...#Channels]
 }
 
@@ -17,4 +16,4 @@
 
 #AcceptableAppName:           string & !="" & =~"^[a-zA-Z0-9_-]+$"
 #AcceptableChannelName:       string & !="" & =~"^[a-zA-Z0-9._-]+$"
-#AcceptedPlatforms:        "linux/amd64" | "linux/arm64"
\ No newline at end of file
+#AcceptedPlatforms:        "linux/amd64" | "linux/arm64"