Chainguard Blog

Is this a response to Chainguard? https://www.chainguard.dev/

I was using wolfi for an oss project, but the recent attempts at forcing payments when pinning version was a huge red flag, as was the messaging around it, and I’ll be migrating away from it. https://www.chainguard.dev/unchained/scaling-chainguard-images-with-a-… Pinning a language version (say python 3.11) isn’t an optional thing its a best practice, and the notion that its because of security seems intentionally misleading as the images should be refreshed in place on the tag along with signatures.

Chainguard | Product Manager, Scanner | REMOTE | Full-Time | https://www.chainguard.dev/ Chainguard is the trusted source for open source. We build hardened, minimal, continuously-updated images, libraries, and packages that eliminate vulnerabilities before they ship — used by teams at Anduril, Canva, OpenAI, Snap, and Snowflake, among others. We're hiring a PM to own the malware and greyware scanning engine inside Chainguard Repository — the system that analyzes source code, build behavior, and maintainer activity across the open source packages flowing through our platform to catch compromised or malicious artifacts before they reach a customer's environment. You'd own the roadmap for detection coverage, scanner accuracy (precision/recall trade-offs are the daily grind), and how findings get surfaced to security teams and translated into policy enforcement. Close partnership with our detection engineering and threat research teams, and with customers who are increasingly asking "how do you know this package is safe?" Good fit if you've done PM work on a detection, fraud, spam, or security scanning system before, are comfortable being hands-on with data and false-positive/false-negative trade-offs, and want to work on a problem that's getting more urgent as AI agents pull in more open source dependencies automatically. JD to be posted imminently but email me if interested and I'll route appropriately: [email protected]

> When it appears in diverse multiple places simultaneously, I generally believe someone is coordinating a media campaign. You may think that's paranoid but look at the merits of the argument: how else is it explained? They didn't coincidentally think of the exact same argument This counterargument? I think my comment still applies. One of them had an original thought and the other copied them. However, on further research I think at least with this article you are correct. The guy works for Chainguard [1] so he has a financial interest in the Iron Bank no longer existing. The guys previous article for Log4J [1] is arguing for public funds to be spent auditing OSS. And given his current work I don't think he's against FOSS; just as long as you get the FOSS through him. [1]: https://www.chainguard.dev/ [2]: https://www.defenseone.com/ideas/2022/08/military-should-red-team-open…

I'm very sorry that we broke things for you. To be clear, nothing has changed with Wolfi. Wolfi is an open source community project and everything is still available there: https://github.com/wolfi-dev/. We have made changes to Chainguard Images - our commercial product built on top of Wolfi - which mean you can no longer pull images by tag (other than latest). Chainguard images are rebuilt everyday and have a not inconsiderable maintenance cost (and the money we make here directly helps us support Wolfi). The easiest way to avoid this is to build the images yourself. You can rebuild identical images to ours using apko and the source files in the images repo e.g: https://github.com/chainguard-images/images/blob/main/images/nginx/con… (note you can replace package names with versioned versions). You can also just use a Dockerfile with the wolfi-base image to "apk add" packages. Full details are here: https://www.chainguard.dev/unchained/a-guide-on-how-to-use-chainguard-… I agree that pinning is a best practice. The above blog explains that you can still do it using a digest, but I accept this isn't the simplest solution. If I can help any more, please feel free to get in touch - you can find me most places including twitter https://twitter.com/adrianmouat

Maybe the author isn't aware that Chainguard is going to keep patching MinIO for CVEs: https://www.chainguard.dev/unchained/secure-and-free-minio-chainguard-… You wouldn't get the other changes in this post (e.g., restoring the admin console) but that's a bit orthogonal.

IIUC chainguard is this, but only for python, java, and docker images so far. https://www.chainguard.dev/libraries

fyi, the good chainguard folks (and former googlers who started kaniko) have forked kaniko Blog post: https://www.chainguard.dev/unchained/fork-yeah-were-bringing-kaniko-ba… The fork: https://github.com/chainguard-dev/kaniko

I'd expect it to be harder. I used to work on a large embedded device that ran some Java code, and there was a specialist vendor providing Java for the offbeat processor platform. After a little digging, I found a blog post about it, and it does sound denser than the poster's plans to bootstrap Rust: https://www.chainguard.dev/unchained/fully-bootstrapping-java-from-sou…

Personally? I've done quite a bit here although there's always more. I worked at Google to fund Rust development internally and externally, helped sponsor the work that eventually led to getting Rust adopted in the Linux kernel, and now run a company that's building a new Linux distribution that prioritizes shipping code written in memory safe languages. https://security.googleblog.com/2021/02/mitigating-memory-safety-issue… https://www.chainguard.dev/unchained/building-the-first-memory-safe-di…

Wasn't really sure where this was going, but the background to this approach adds some details - namely what they mean by distro-less and how they pull it off. https://www.chainguard.dev/unchained/minimal-container-images-towards-…

It's a challenge but seems to be becoming moire prevalent for folks focused on supply chain attacks. Chainguard in particular has a bunch of standard containers (e.g. nginx) that reduce the container footprint as much as possible. https://www.chainguard.dev/chainguard-images

Think of a circle with a fine split in it. At one end there's using a distro. You go around the circle to distroless, and on the other end of the circle, close to using a distro, but not using a distro, is un-distro. Paraphrased in jest from https://www.youtube.com/watch?v=_OEO79B-CZ4 Seems they use it to highlight it's not just distroless but also kernel-less[1]. [1]: https://www.chainguard.dev/unchained/introducing-wolfi-the-first-linux… (last section)

You could also leak private repo names via GHCR: https://www.chainguard.dev/unchained/ghcr-private-repos-sometimes-were…