Container lifecycle and end of life on

Chainguard Containers product release lifecycle

Mon, 08 Jan 2024 08:49:31 +0000

Chainguard Containers are able to offer few-to-zero known vulnerabilities because they are updated frequently. Because of this continuous release cycle, the best way to mitigate vulnerabilities is to use the newest build of each Chainguard Container available. Chainguard keeps Containers up to date by doing one or more of the following:

Applying new releases from upstream projects
Rapidly applying upstream patches to current releases — you can read more about this in our blog post, “How Chainguard fixes vulnerabilities before they’re detected”
Applying Chainguard patches to OSS software

Upstream projects are updated frequently for many reasons, including to combat CVEs, and Chainguard ensures that the most up-to-date software is available in all Chainguard Containers. Additionally, Chainguard often identifies CVEs and other issues before scanners can detect them, so Chainguard may offer a patch to a vulnerable dependency to support Chainguard Containers with few-to-zero vulnerabilities.

Chainguard end-of-life grace period for containers

Wed, 14 May 2025 08:49:31 +0000

Typically, specific versions of software receive updates on a schedule for a set amount of time. Eventually, though, every version of software will stop receiving support. When project maintainers stop providing updates, it’s known as the End-of-Life (EOL) stage.

It’s recommended that when a software version reaches the EOL phase, users should migrate their projects to a later version, as EOL software is known to accumulate vulnerabilities. However, there are cases where an organization may want to continue using a container image after it has reached end-of-life. This could be because an image reaches EOL before the organization’s release schedule, or perhaps later image versions have one or more issues that prevent the organization from upgrading.

How end-of-life software accumulates vulnerabilities

Wed, 04 Dec 2024 11:07:52 +0200

Because it’s no longer being actively maintained, software begins to collect vulnerabilities when it reaches EOL. This problem can become compounded when using container images, as they often come with extra components from underlying base images which are all prone to accruing vulnerabilities. This can lead to images with hundreds of components, each collecting vulnerabilities and forming part of the attack surface.