Wolfi FAQs

What is Wolfi and how does it compare to Alpine?

Wolfi is our Linux undistro designed from the ground up to support newer computing paradigms such as containers. Although Wolfi has a few similar design principles as Alpine (such as using apk), it is a different distribution that is focused on supply chain security. Unlike Alpine, Wolfi does not currently build its own Linux kernel, instead relying on the host environment (e.g. a container runtime) to provide one.

Why build a new Linux distribution from scratch?

Without building packages from source, you are at the mercy of an intermediary provider (such as Debian or Alpine) for obtaining the software you need, and none of those intermediaries offer our SLA around zero CVEs. Each intermediary also joins your supply chain’s root of trust. We built Wolfi to achieve an unmatched CVE SLA where Chainguard is the only intermediary you need to trust. The following resources have more details around why and how we built Wolfi:

1. Building the first memory safe distro
2. Building Wolfi from the ground up
3. Wolfi: a new paradigm in Linux for containers
4. Fully bootstrapping Java from source in Wolfi
5. Fully bootstrapping Go from source in Wolfi

Is Wolfi free to use?

Yes, Wolfi is free and will always be.

Can I mix packages from Alpine repositories into a Wolfi-based image?

No, it’s not possible to mix Alpine apks with Wolfi apks. If your image requires dependencies that are currently only available for Alpine, you might consider opening a new issue in the wolfi-os repository to suggest the new package addition, or use melange to build a custom apk for your image.

How can I find which packages are available in Wolfi?

You can search for available packages using the apk search command from within a Wolfi container, as explained in the Searching for Packages section of our Migrating to Chainguard Images guide. You can also use our APK Explorer tool for a web-based search on the Wolfi repositories.

Can I use Wolfi on the Desktop?

No. Wolfi is an un-distro, or distroless base to be used within the container / OCI ecosystem. Desktop distributions require additional software that is out of scope for Wolfi’s roadmap.

Who maintains Wolfi?

Wolfi was created and is currently maintained by Chainguard.

What are the plans for long-term Wolfi governance?

We intend for Wolfi to be a community-driven project, which means over time it will have multi-vendor governance and maintainers. For now we’re focused on building the project and community, and will revisit this in several months when a community has formed.

Where can I get security feeds for Wolfi?

See SECURITY.md for information about reporting security incidents concerning and consuming security data about Wolfi.