Chainguard Academy

Product Docs

    • Overview
      • Build Criteria
      • Shared Responsibility Model
      • Going Distroless
      • How Images are Tested
      • Dev vs. Production Images
      • Product Release Lifecycle
        • Images for Compiled Programs
        • glibc vs. musl
      • Video: Low-to-No CVEs
      • Video: Beyond Zero
      • Custom Assembly
      • STIGs
      • Unique Tags
      • Tag History API
        • FIPS FAQs
        • FIPS Images
      • CVE Visualizations
      • Custom Certificates
      • EOL Notifications
      • Using Chainguard Images
      • Retrieve an Image's SBOM
      • Verifying Images
      • Images Directory
      • Compare Images with chainctl
      • Video: Using the Static Base Image
      • Video: Image Digests
      • Video: Reproducible Dockerfiles with Frizbee and Digestabot
      • Video: Software Versions
      • Video: Minimal Runtime Images
      • C/C++
      • Cilium
      • Go
      • Istio
      • Laravel
      • MariaDB
      • NeMo
      • nginx
      • Node
      • PHP
      • PostgreSQL
      • Python
      • PyTorch
      • Ruby
      • WordPress
      • Minimize CVE Risk
      • FedRAMP Considerations
      • Video: Reproducibility and Chainguard Images
        • Image Update Considerations
        • EOL Vulnerabilities
        • Update Strategies and Tools
        • Using Renovate
        • Video: Up-to-date Images with Digestabot
        • Using Advisories
        • Advisory Life Cycle
        • Managing Advisories
        • False Positives and Negatives
        • Grype
        • Trivy
      • Debugging
      • Video: Debugging Distroless Containers
      • Video: Debugging with Kubectl and CDebug
      • bash
      • busybox
      • curl
      • deno
      • dex
      • dotnet-runtime
      • dotnet-sdk
      • etcd
      • git
      • go
      • gradle
      • haproxy
      • jenkins
      • kube-state-metrics
      • mariadb
      • maven
      • memcached
      • minio
      • minio-client
      • nats
      • nginx
      • node
      • opensearch
      • php
      • postgres
      • python
      • r-base
      • rabbitmq
      • redis
      • ruby
      • rust
      • telegraf
      • traefik
      • wait-for-it
      • wolfi-base
      • zookeeper
    • FAQs
    • Registry Overview
    • Authenticate to Chainguard Registry
      • Google Artifact Registry
        • Registry Pull-Through
        • Mirroring Packages
      • Nexus
      • Cloudsmith
    • Migration Overview
    • Porting a Sample Application
    • Migrating Dockerfiles
    • Migration Checklist
      • Alpine
      • Debian
      • Ubuntu
      • Red Hat
      • PHP
      • Node
      • Video: Node.js
      • Python
      • Video: Go
      • Video: Java
    • Network Requirements
    • Install chainctl
    • chainctl Config
    • Terraform Provider
      • IAM Overview
      • Manage IAM Organizations
      • Verified Organizations
        • Roles and Role-bindings Overview
        • GitHub Team Role-binding
      • Assumable IDs Overview
        • GitHub Actions
        • GitLab CI/CD
        • AWS
        • Buildkite
        • Bitbucket
        • Jenkins
        • Keycloak
      • Authenticate with Custom IDPs
        • Okta
        • Ping Identity
        • Microsoft Entra ID
      • Mirror Images to Artifact Registry
      • Chainguard Events
    • OpenAPI Specification
    • chainctl
    • chainctl auth
    • chainctl auth configure-docker
    • chainctl auth login
    • chainctl auth logout
    • chainctl auth pull-token
    • chainctl auth status
    • chainctl auth token
    • chainctl config
    • chainctl config edit
    • chainctl config reset
    • chainctl config save
    • chainctl config set
    • chainctl config unset
    • chainctl config validate
    • chainctl config view
    • chainctl events
    • chainctl events subscriptions
    • chainctl events subscriptions create
    • chainctl events subscriptions delete
    • chainctl events subscriptions list
    • chainctl iam
    • chainctl iam account-associations
    • chainctl iam account-associations check
    • chainctl iam account-associations check aws
    • chainctl iam account-associations check gcp
    • chainctl iam account-associations describe
    • chainctl iam account-associations set
    • chainctl iam account-associations set aws
    • chainctl iam account-associations set gcp
    • chainctl iam account-associations unset
    • chainctl iam account-associations unset aws
    • chainctl iam account-associations unset gcp
    • chainctl iam folders
    • chainctl iam folders delete
    • chainctl iam folders describe
    • chainctl iam folders list
    • chainctl iam folders update
    • chainctl iam identities
    • chainctl iam identities create
    • chainctl iam identities create github
    • chainctl iam identities create gitlab
    • chainctl iam identities delete
    • chainctl iam identities describe
    • chainctl iam identities list
    • chainctl iam identities update
    • chainctl iam identity-providers
    • chainctl iam identity-providers create
    • chainctl iam identity-providers delete
    • chainctl iam identity-providers list
    • chainctl iam identity-providers update
    • chainctl iam invites
    • chainctl iam invites create
    • chainctl iam invites delete
    • chainctl iam invites list
    • chainctl iam organizations
    • chainctl iam organizations delete
    • chainctl iam organizations describe
    • chainctl iam organizations list
    • chainctl iam role-bindings
    • chainctl iam role-bindings create
    • chainctl iam role-bindings delete
    • chainctl iam role-bindings list
    • chainctl iam role-bindings update
    • chainctl iam roles
    • chainctl iam roles capabilities
    • chainctl iam roles capabilities list
    • chainctl iam roles create
    • chainctl iam roles delete
    • chainctl iam roles list
    • chainctl iam roles update
    • chainctl images
    • chainctl images diff
    • chainctl images list
    • chainctl images repos
    • chainctl images repos list
    • chainctl packages
    • chainctl packages versions
    • chainctl packages versions list
    • chainctl update
    • chainctl version

Open Source

      • apko Overview
      • apko FAQs
      • Getting Started with apko
      • Troubleshooting apko Builds
      • Bazel Rules
      • melange Overview
      • Getting Started with melange
      • Troubleshooting Builds
      • melange FAQs
    • What is SLSA?
    • What is an SBOM?
    • OpenVEX and vexctl
    • What Makes a Good SBOM?
    • What is OpenVex?
    • SBOMs and Attestations
    • Wolfi Overview
    • Building a Wolfi Package
    • Wolfi FAQs
    • Why apk
    • Hello Wolfi Workshop
    • Wolfi Images with Dockerfiles
    • Package Version Selection
    • What is the OCI?
    • What are OCI Artifacts?
    • Keyless Signing
      • An Introduction to Cosign
      • How to Install Cosign
      • How to Sign a Container with Cosign
      • How to Sign Blobs and Standard Files with Cosign
      • How to Sign an SBOM with Cosign
      • How to Verify File Signatures with Cosign
      • Cosign: The Manual Way
      • How to Install Sigstore Policy Controller
        • Enforce SBOM attestation with Policy Controller
        • Disallowing Non-Default Capabilities
        • Disallowing Privileged Pods
        • Disallowing Run as Root User
        • Maximum Container Image Age
        • Disallowing Unsafe sysctls
        • Verify Signed Chainguard Images
        • Critical CVEs
        • Rego Policies
        • Example Policies
      • An Introduction to Fulcio
      • How to Generate a Fulcio Certificate
      • How to Inspect and Verify Fulcio Certificates
      • An Introduction to Rekor
      • How to Install the Rekor CLI
      • How to Query Rekor
      • How to Sign and Upload Metadata to Rekor
      • How to Verify File Signatures with Rekor or curl
      • How to Set Up An Instance of Rekor Instance Locally

Education

  • Containers
  • Selecting a Base Image
  • Software Supply Chain Security
  • Chainguard Glossary
  • Trademark Use Policy
      • Introduction to the PCI Data Security Standard (DSS) 4.0
      • Overview of PCI DSS 4.0 Practices/Requirements
      • Simplify Your Path to PCI DSS 4.0 Compliance with Chainguard
      • Introduction to the Cybersecurity Maturity Model Certification (CMMC) 2.0
      • CMMC 2.0 Maturity Levels
      • Overview of CMMC 2.0 Practices/Control Groups
      • Simplify Your Path to CMMC 2.0 Compliance with Chainguard
    • CIS Benchmarks
    • #1 - Fighting Vulnerabilities
    • What Are Software Vulnerabilities and CVEs?
    • Why Care About Software Vulnerabilities?
    • Infamous Software Vulnerabilities
    • Software Vulnerability Remediation
    • Self-Attestation Form
    • Table of NIST SSDF
    • Minimum Attestation References
Go to Chainguard.dev
Send feedback Contact

John Speed Meyers

Security Data Scientist at Chainguard

Selecting a Base Image

What is software supply chain security

What Makes a Good SBOM?

Product
Chainguard Images Images Directory
Why Chainguard
Container Image Security Vulnerability Remediation Compliance & Risk Mitigation Software Supply Chain Security AI/ML Security
Customers
Customer Stories Chainguard Love
Company
About Us Open Source Careers Newsroom Legal Contact
Resources
Unchained Blog Research Events Documentation
Follow Chainguard on GitHub Follow Chainguard on X Follow Chainguard on YouTube Follow Chainguard on LinkedIn © 2025 Chainguard. All Rights Reserved.