People listen to people, not brands

It has been amazing to work with Chainguard, I never would have believed that getting to a 0 CVE image would be so easy (heck, I wouldn't have believed it was even possible) before we introduced Chainguard into our workflow.

‍

‍

Did I mention that FilterBox uses @chainguard_dev images so it’s secure af (that’s a technical term)

We adopted Chainguard stack (melange/apko/images) at work and everyone has been super happy since. We wrote a tiny bit to automate image digest updates when we rebuild the base images.

As the name suggests these images are designed for security and reduce your attack surface.

‍‍

#chainguard #images #security

I know @chainguard_dev images aren't magic, but hard work.. but it's the closest thing to a magic wand for CVEs I've seen

That one is even better 🥳 #rejekts2023 basically you are screwed unless you use ⁦@chainguard_dev⁩ 🤗

Underrated benefit of Chainguard images, I can still pull them on hotel WiFi. 🥲

I recently gave the cgr.dev/chainguard/nginx container image a try, here are my learnings! Towards having more secure container images!

https://lnkd.in/eXtr2yf5

‍😍

Now it's time for the Container image. I default nowadays to using @chainguard images with multi-stage builds for python. these base images are not only lightweight but don't have the vulns

‍

And I sign them with @projectsigstore cosign before pushing it to container registry

I really love what @chainguard_dev is doing with Wolfi.  https://github.com/chainguard-dev/wolfi-os  I'll definitely be using it for anything that doesn't work on scratch.

We've begun using more @chainguard_dev images internally. They have zero CVEs 🤯. We recently learned our air gap tool http://Zarf.dev is now available in @wolfi_os. This is one of the many reasons we love the open source community. We can all get better together!

Love all the things @chainguard_dev  are doing. They all aligns very well with what we are trying to do here at VPBank: build a set of secure base images on top of Wolfi OS; as well as trying to make arm64 first class citizen too, along with amd64 (thanks to apko).

I've been playing around with apko, distroless and melange from @chainguard_dev, and made a little toolbox image for continuous deployment to #kubernetes. I love how convenient it is to build reproducible multi-arch images with these tools!

Quarterly reminder - My love for @wolfi_os and the work folks at @chainguard_dev continues to grow.

perfect timing as Zarf just added @chainguard_dev base images. Love what your doing and the value you are providing to the greater community.

Game changer? Not many reasons not to use @chainguard_dev  images now.

Rockin 0 CVEs in my base images due to Chainguard and now got an awesome shirt to tell the world! Sure there’s other ways to achieve this, but the effort on my end is minimal and I don’t have to worry about the sources of the packages. I’m not normally one to boast about a specific vendor, but 🤯.

My life feels so much more relaxed since I started using Chainguard images :-)

‍@chainguard_dev @adrianmouat #WTFisSRE

Chainguard really does look like it can transform the software supply chain for the greater good - just needs more eyes on it and commitment to adopt; I see almost no reason not to migrate services to these images; especially when there are like for like images available with what you need. Swapping a single line in your Dockerfile with a different source for your base image is all that is needed.

Putting #security and minimalism first -

‍

‍

I migrated Luminous Onion from a vulnerable base image to Chainguard's image built with #Wolfi dropping the vulnerabilities to a manageable 0 count! All with only 2 lines of code changed. Yes, it's really that easy!

‍

Highly recommend checking out Chainguard images for your projects.

The @chainguard_dev images are so cool. And super lite weight.

‍

Just shipped some Go code that builds a pretty simple server and it's much much smaller with Wolfi build images🧵

updated Resonate's Dockerfile to use @chainguard_dev rather than Docker's official Go image.  

‍

Resonate (docker): 848MB

Resonate (chainguard): 35.3MB

‍

96% image size reduction and 0 CVEs!? 👀

I hadn’t heard of the Chainguard container registry yet. This sounds super cool. I’d trust their images over anything else out there.

We are going all in on Chainguard tech stack. After adopting melange, apko & Chainguard Images, we are going with cosign, self-hosted rekor and fulcio, .. the whole shebang, next.

‍

Exciting time ahead.

Hey I love you @chainguard_dev and you are seriously crushing it.

Okay, will do. Thanks much! This is what I love about @chainguard_dev. You'll are so active and "passionate".

Congrats Chainguard team on shipping this.

‍

I imagine demand for this will be very high due to the nature of high impact, low effort when adopting Chainguard Images.

‍

Seriously, many images are drop-in compatible with popular, official one. 1 line change and all the CVE are gone :)

Came just a few days after we swapped over Zarf's agent image to use Chainguard's static image as a base

Playing with Chainguard & #wolfi to build zero #cve #docker images for #magento and #php 🧑‍💻🤓

I predict Wolfi and the Chainguard base images are going to replace a lot of my defaults in 2023! I need to do more real-world testing, but I love what they are doing over there. #docker #kubernetes #devops #devsecops

How small a Java application container image can be?

‍

The answer is: Pretty damn small (8MB). For comparison, alpine:latest is approx 7MB.

‍

See how I built it here 👉 https://lnkd.in/gMnZ_q_q

‍

#chainguard #melange #apko #wolfios #graalvm