Building Images For The Secure Supply Chain
summary
Scans show big base images overflowing with CVEs (example: official nginx image ~86 vulns, a node image once reported 658); Chainguard cuts that to zero vulnerabilities by three concrete moves: cut dependencies (smaller package sets like Wolfi vs Debian), keep images updated (rebuilds in minutes using Wolfi-dev and melange instead of waiting weeks), and publish security advisories plus targeted patches; builds use apko, produce SBOMs and reproducible images.
AI-written summary · about
chapters (7)
related talks
28mBuilding Images for the Secure Supply Chain
24mStart Securing your Base Images by Making your Own Distroless
37mSupply Chain Security in Kubernetes
20mHow Secure is Your Base Image? ...
32mWhat Data Tells Us About Software Supply Chain Security & What To Do About It
25mMy Container Image has 500 Vulnerabilities, Now What?
38mSecuring the chains: Building defensive layers for software supply chains
16mUnpacking Open Source Security in Public Repos