Building and modifying Chainguard Containers on

Installing APK packages in distroless variants

Tue, 21 Apr 2026 00:00:01 +0000

This page documents workflows for installing APK packages in distroless variants of Chainguard container images, such as most builds tagged :latest. We copy a filesystem from a distroless container image to a build image, install APKs to it using chroot, then copy the modified filesystem back to the distroless image in the final step.

Overview: Installing packages in distroless containers

The distroless variants of Chainguard Containers do not contain shells or package managers by design. This reduces attack surface and exploitability for these images. In cases where additional packages are required, we typically recommend the following:

Using the Chainguard static base container image

Wed, 30 Aug 2023 15:21:01 +0000

Tools used in this video

Docker
Grype

Dockerfile

FROM cgr.dev/chainguard/go AS build
COPY main.go /main.go
RUN CGO_ENABLED=0 go build -o /hello /main.go
FROM cgr.dev/chainguard/static
COPY --from=build /hello /usr/local/bin/
CMD ["hello"]

Transcript

So what’s the best container base image to use?

Building minimal container images for applications with runtimes

Wed, 06 Sep 2023 01:21:01 +0000

Tools used in this video

Docker

Resources

The Dockerfiles used in this video and other supporting documentation are available on GitHub.

Chainguard packages

Fri, 12 Sep 2025 08:48:45 +0000

Build tools

Fri, 04 Sep 2026 00:00:00 +0000