Static Chainguard Container Images

The September 2025 Learning Lab, led by Adrian Moat, focuses on minimizing the attack surface of container images by adopting Chainguard’s static and minimal images, which boast zero known CVEs. Adrian demonstrated a container build for a Go-based application and explains more complex use cases.

Sections

• 00:01 Welcome and introductions
• 03:34 Talk outline and prerequisites
• 04:34 Understanding CVEs
• 07:34 Introducing Chainguard Containers
• 08:58 Vulnerability and size comparison
• 10:14 Why Chainguard images are more secure
• 11:46 Practical demo: Migrating a Go container image
• 15:01 Initial build
• 17:59 Migration to Chainguard base image
• 20:45 Multi-stage build and static image optimization
• 27:39 Static vs. dynamic binaries
• 30:16 Chainguard Container variants
• 32:34 Distroless Containers and dev images
• 33:30 Debugging Distroless containers demonstration
• 44:57 Key takeaways and wrap-up
• 46:44 Next Learning Lab announcement
• 47:50 Resources for further learning

Resources

• Slide deck