Chainguard Containers concepts on

Chainguard shared responsibility model

Thu, 17 Oct 2024 11:07:52 +0200

Chainguard’s mission is to be the safe source for open source. As part of this mission, Chainguard builds all of our packages and images from upstream open source code and delivers the resulting artifacts to our customers. There are three distinct parties involved here: Upstream projects, Chainguard, and Customers; each of these parties share some measure of responsibility across a few dimensions.

This guide is an overview of Chainguard’s Shared Responsibility Model: a framework that outlines the security responsibilities of upstream open source software projects, Chainguard, and its customers. The dimensions of shared responsibility this guide covers are:

Understanding Chainguard's container image categories

Thu, 03 Apr 2025 11:07:52 +0200

Chainguard Containers are a collection of curated, distroless container images designed with a focus on software supply chain security. Chainguard’s container images are designed to be slim runtimes for production environments, emphasizing security and efficiency by removing unnecessary elements. Additionally, the images are designed to be easily integrated into existing workflows, helping organizations to build better, more secure software.

Within the Chainguard Containers Directory, Chainguard Containers are organized into five general categories (with some falling into multiple categories):

Chainguard's container variants

Fri, 01 Nov 2024 07:52:00 +0200

Chainguard Containers follow a distroless philosophy, meaning that only software absolutely necessary for a specific workload is included in an image. Designed to be as minimal as possible, Chainguard’s standard container images do not contain package managers such as apk, shells such as b/a/sh, or development utilities such as Git or text editors. However, this distroless approach isn’t suitable for every use case. For this reason, most Chainguard Containers have what’s called a development variant.

Getting started with distroless container images

Thu, 21 Mar 2024 08:49:31 +0000

About distroless container images

Distroless container images, like the ones built by Chainguard, are a type of container image designed to include only essential software required to run an application or service. Unlike traditional images based on Debian or Ubuntu — which include package managers, utilities, and shells — Chainguard’s distroless images remove these components to significantly reduce attack surface and minimize vulnerabilities.

Choosing a base container for your compiled programs

Fri, 12 Jul 2024 17:55:01 +0000

When selecting the right base image for your application, there are a variety of factors to take into consideration. For starters, it is critical that your application has all of the dependencies it needs to run. The ideal base image will contain the essential packages you need, while leaving out the ones you don’t. However, in practice, you will need to build upon your container images so they meet your specific needs, making it all the more important that you have a strong foundation.

glibc vs. musl

Mon, 26 Aug 2024 18:42:57 +0000

Over the years, various implementations of the C standard library — such as the GNU C library, musl, uClibc-ng, and many others — have emerged with different goals and characteristics. These various implementations exist because the C standard library defines the required functionality for operating system services (such as file input/output and memory management) but does not specify implementation details. Among these implementations, the GNU C Library (glibc) and musl are among the most popular.

How Chainguard creates container images with low-to-no CVEs

Fri, 31 May 2024 12:21:01 +0000

Tools and resources used in this video

Note: In November 2024, after this article was first written, Chainguard made changes to its free tier of container images. In order to access the non-free container images used in this guide, you will need to be part of an organization that has access to them. For a full list of container images that will remain in Chainguard's free tier, please refer to this support page.

How Chainguard builds and tests containers

Fri, 04 Sep 2026 00:00:00 +0000

Container lifecycle and end of life

Fri, 04 Sep 2026 00:00:00 +0000

Can anybody build Chainguard Containers themselves?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: But everything is open source—can anybody build the images themselves?