6 ms·

Chainguard Images now available on Docker Hub

79 points by hasheddan 3y ago

dlor 3y ago
I work at Chainguard, happy to answer any questions!
- Operyl 3y ago
  EDIT: upon using dockerhub’s organization page for a bit, and realizing there’s no search on the organization page (I swear there was?), I now understand. Why does the article present this bizarre set of instructions for grabbing the image instead of linking directly? You could just link your organization no? > Getting started with Chainguard Developer Images in Docker Hub is easy. Follow these simple steps: > Look up the Image you want. > Select ‘Recently Updated’ from the dropdown menu on the right. > Filter out the community images by selecting the filter ‘Verified Publisher.’ > Copy the pull command, paste it into your terminal, and you are all set.
  - dlor 3y ago
    Good callout, if you know how to use docker and and dockerhub then it's just as easy as `docker pull chainguard/node`
- jamesdwilson 3y ago
  If a primary goal of a consumer of the images is security, how can we trust the images not to have backdoors or virusesesses [extra s added for comedy]?
  - dlor 3y ago
    Great question! We take hardening of our build infrastructure very seriously, and helped build many of the OSS technologies in this space like the SLSA framework and the Sigstore project. We produce SBOMs during the build process, and cryptographically sign SLSA-formatted provenance artifacts depicting the entire build process so you can trace a built container all the way back to the sources it was built from. We also try to make as much of our build system reproducible as possible (but we're not all the way there yet), so you can audit or rebuild the process yourself.
  - tuananh 3y ago
    The images repo is here https://github.com/chainguard-images/images https://github.com/chainguard-images/images
- remram 3y ago
  I read the blog, then I clicked on the big "back" button at the top labeled "Unchained" and read that, then I went to your homepage and read that, then I clicked "get started" and read that page too. I still have no idea what Chainguard is, or what those images do. All I know is those images are "hardened", is that the only thing they're for? Is that Chainguard's product?
  - jacques_chester 3y ago
    Not at Chainguard but I've watched their growth. I think this comes down to audience. To a lot of engineers it's just like ... "OK, that's nice. What else?" But for security teams in large enterprises, Chainguard is like manna from heaven. They immediately understand what is really being sold: the elimination of enormous amounts of compulsory toil due to upgrading vulnerable software -- or having to nag other teams to do it. It's a bit like visiting the site of a medical devices manufacturer. I probably don't know what the device does, but the target audience sure do.
    - candiddevmike 3y ago
      > But for security teams in large enterprises, Chainguard is like manna from heaven. They immediately understand what is really being sold: the elimination of enormous amounts of compulsory toil due to upgrading vulnerable software -- or having to nag other teams to do it. Explain to me how Chainguard helps with this. Everywhere I've worked, this process has very specific needs depending on the companies internal and regulatory requirements. Chainguard may help with proof of origin/base imaging, but it doesn't do much beyond what container registries and tools like dependabot/snyk/dependency track already provide (not saying they're directly related), which doesn't really reduce that much toil.
      - jacques_chester 3y ago
        It doesn't eliminate all toil, but it eliminates a lot. At least their customers think so.
mvdtnz 3y ago
I read the entire chain guard landing page and still have absolutely no idea what this product is.
- password4321 3y ago
  Per their website: > Minimal, hardened images with SBOMs and signatures > Get free Chainguard Images for your organization. Upgrade for more versions, SLAs, and dedicated support.
- iaresee 3y ago
  Took me a scroll as well to sort this out. Looks like they’re producing low-CVE images for use in environments where being very on top of CVE squashing is super important
- ryanianian 3y ago
  0-CVE base images and a package ecosystem. Very useful if you ship containers as products to security-sensitive folks.
  - jacques_chester 3y ago
    Chainguard is proof that modern CI/CD is still a luxury product for most of the industry. They have a fantastic amount of automation behind image production, including some tools they rolled themselves (like apko). Disclosure: I am friends with / have worked with some Chainguard folks.
    - ryanianian 3y ago
      Declarative image builds, nightly rebuilds of the whole ecosystem, and they bake the SBOM into the images. It is a really good offering. It's a shame we had to use the competing offering from RedHat for contractual reasons.
- MordodeMaru 3y ago
  What images do you usually use and where do you get them from?
simonw 3y ago
"Today, Chainguard announced that it has become a Docker Verified Publisher (DVP)" Anyone know how that works? Does Chainguard need to pay Docker for this? What does the verification process look like?
- dlor 3y ago
  The program details are here: https://docs.docker.com/trusted-content/dvp-program/ https://docs.docker.com/trusted-content/dvp-program/
  - opello 3y ago
    Unfortunately across the various links ([1] [2] [3] [4]) there aren't really many details that answer those questions (that I was also curious about). [1] https://docs.docker.com/trusted-content/dvp-program/ https://docs.docker.com/trusted-content/dvp-program/ Explains perks and Docker Hub analytics features, but doesn't explain requirements. It does link to ... [2] https://www.docker.com/partners/programs/ https://www.docker.com/partners/programs/ a sign up page that entices you to fill out a contact form if you want to learn more. And links to 2 new pages (and [1]) at the bottom: [3] https://www.docker.com/press-release/docker-expands-trusted-content-offerings/ https://www.docker.com/press-release/docker-expands-trusted-... the first of which is a press release explaining the value of the program. [4] https://www.docker.com/blog/docker-verified-publisher-trusted-sources-trusted-content/ https://www.docker.com/blog/docker-verified-publisher-truste... The second is this blog post which highlights trust and again Docker Hub features (e.g. rate limit removal, metrics, badging) and links back to [2] for more details. The third link is [1]. So, I'm still left curious about the grandparent comment's questions. It seems these pages are sparse on what the verification process looks like and if it might just be a "pay to play" relationship.
amouat 3y ago
I did a short YouTube version of the announcement: https://www.youtube.com/watch?v=QuyBWDx21d0 https://www.youtube.com/watch?v=QuyBWDx21d0
deleted 3y ago
[deleted]
KyleSanderson 3y ago
so... FROM:scratch ? Might be worthwhile restating the companies business model in announcements like this, especially for people unfamiliar with the area. This sounded like some wireguard thing from the name, only to discover it's just an org delivering statically linked binaries in a scratch docker image to defeat scanners...
- dlor 3y ago
  There's no defeating of scanners or even static linking. It's all automation, dynamic linking and patching to make the scanners happy. We go to great lengths to make sure that the scanners actually find everything so the results are accurate.
- amouat 3y ago
  Sort of. A few things though: - we don't use scratch. Our base image is chainguard/static which includes certs and a few other things typically needed by apps. - we have our own Linux distribution called Wolfi - we don't "defeat scanners". We work with scanners and publish security advisories. They recognise Wolfi. You can definitely find some images of ours that have CVEs (especially if you have an old image lying around).
tuananh 3y ago
lots of questions here regarding what this product is. I guess i can provide some information for the context, from a perspective of an outside contributor. Chainguard Images is a set of hardened container images. They were built by the original team that brought you Google's Distroless (https://github.com/GoogleContainerTools/distroless https://github.com/GoogleContainerTools/distroless) However, there were few problems with Distroless: 1. distroless were based on Debian - which in turn, limited to Debian's release cadence for fixing CVE. 2. distroless is using bazelbuild, which is not exactly easy to contrib, customize, etc... 3. distroless images are hard to extend. Chainguard built a new "undistro" OS for container workload, named Wolfi, using their OSS projects like melange (for packaging pkgs) and apko (for building images). The idea is (from my understanding) is that 1. You don't have to rely on upstream to cut a release. Chainguard will be doing that, with lots of automation & guardrails in placed. This allow them to fix vulnerabilties extremely fast. Why go through all the analysis, etc.. where you can patch it very quickly. 2. The OS is glibc-based. Which is a lot more friendly than Alpine. 3. It's pretty much YAML which is kinda easy to package software into APK packages & then images (with apko) 4. SBOM and a lot more. But that's stuff on top of my head.
- tuananh 3y ago
  Wolfi OS: https://github.com/wolfi-dev/os https://github.com/wolfi-dev/os melange (for packaging software): https://github.com/chainguard-dev/melange https://github.com/chainguard-dev/melange apko (for building image): https://github.com/chainguard-dev/apko https://github.com/chainguard-dev/apko
NovemberWhiskey 3y ago
It would be awesome if the Wolfi base image integrated nicely with Clair at some point too! I think someone was working on that last year but seems like it stalled.
kapilvt 3y ago
I'm excited to see this. One of my reservations on using chain guard images previously was how they only hosted them on their own registry, which had previously yanked access behind a pay wall for using any tag other then latest. At least with this wolfi images (nominally an oss project) won't be locked in a commercial registry vs a defacto public registry.

79 points by hasheddan 3y ago

dlor 3y ago

I work at Chainguard, happy to answer any questions!

Operyl 3y ago
EDIT: upon using dockerhub’s organization page for a bit, and realizing there’s no search on the organization page (I swear there was?), I now understand. Why does the article present this bizarre set of instructions for grabbing the image instead of linking directly? You could just link your organization no? > Getting started with Chainguard Developer Images in Docker Hub is easy. Follow these simple steps: > Look up the Image you want. > Select ‘Recently Updated’ from the dropdown menu on the right. > Filter out the community images by selecting the filter ‘Verified Publisher.’ > Copy the pull command, paste it into your terminal, and you are all set.
- dlor 3y ago
  Good callout, if you know how to use docker and and dockerhub then it's just as easy as `docker pull chainguard/node`
jamesdwilson 3y ago
If a primary goal of a consumer of the images is security, how can we trust the images not to have backdoors or virusesesses [extra s added for comedy]?
- dlor 3y ago
  Great question! We take hardening of our build infrastructure very seriously, and helped build many of the OSS technologies in this space like the SLSA framework and the Sigstore project. We produce SBOMs during the build process, and cryptographically sign SLSA-formatted provenance artifacts depicting the entire build process so you can trace a built container all the way back to the sources it was built from. We also try to make as much of our build system reproducible as possible (but we're not all the way there yet), so you can audit or rebuild the process yourself.
- tuananh 3y ago
  The images repo is here https://github.com/chainguard-images/images https://github.com/chainguard-images/images
remram 3y ago
I read the blog, then I clicked on the big "back" button at the top labeled "Unchained" and read that, then I went to your homepage and read that, then I clicked "get started" and read that page too. I still have no idea what Chainguard is, or what those images do. All I know is those images are "hardened", is that the only thing they're for? Is that Chainguard's product?
- jacques_chester 3y ago
  Not at Chainguard but I've watched their growth. I think this comes down to audience. To a lot of engineers it's just like ... "OK, that's nice. What else?" But for security teams in large enterprises, Chainguard is like manna from heaven. They immediately understand what is really being sold: the elimination of enormous amounts of compulsory toil due to upgrading vulnerable software -- or having to nag other teams to do it. It's a bit like visiting the site of a medical devices manufacturer. I probably don't know what the device does, but the target audience sure do.
  - candiddevmike 3y ago
    > But for security teams in large enterprises, Chainguard is like manna from heaven. They immediately understand what is really being sold: the elimination of enormous amounts of compulsory toil due to upgrading vulnerable software -- or having to nag other teams to do it. Explain to me how Chainguard helps with this. Everywhere I've worked, this process has very specific needs depending on the companies internal and regulatory requirements. Chainguard may help with proof of origin/base imaging, but it doesn't do much beyond what container registries and tools like dependabot/snyk/dependency track already provide (not saying they're directly related), which doesn't really reduce that much toil.
    - jacques_chester 3y ago
      It doesn't eliminate all toil, but it eliminates a lot. At least their customers think so.

mvdtnz 3y ago

I read the entire chain guard landing page and still have absolutely no idea what this product is.

password4321 3y ago
Per their website: > Minimal, hardened images with SBOMs and signatures > Get free Chainguard Images for your organization. Upgrade for more versions, SLAs, and dedicated support.
iaresee 3y ago
Took me a scroll as well to sort this out. Looks like they’re producing low-CVE images for use in environments where being very on top of CVE squashing is super important
ryanianian 3y ago
0-CVE base images and a package ecosystem. Very useful if you ship containers as products to security-sensitive folks.
- jacques_chester 3y ago
  Chainguard is proof that modern CI/CD is still a luxury product for most of the industry. They have a fantastic amount of automation behind image production, including some tools they rolled themselves (like apko). Disclosure: I am friends with / have worked with some Chainguard folks.
  - ryanianian 3y ago
    Declarative image builds, nightly rebuilds of the whole ecosystem, and they bake the SBOM into the images. It is a really good offering. It's a shame we had to use the competing offering from RedHat for contractual reasons.
MordodeMaru 3y ago
What images do you usually use and where do you get them from?

simonw 3y ago

"Today, Chainguard announced that it has become a Docker Verified Publisher (DVP)" Anyone know how that works? Does Chainguard need to pay Docker for this? What does the verification process look like?

dlor 3y ago
The program details are here: https://docs.docker.com/trusted-content/dvp-program/ https://docs.docker.com/trusted-content/dvp-program/
- opello 3y ago
  Unfortunately across the various links ([1] [2] [3] [4]) there aren't really many details that answer those questions (that I was also curious about). [1] https://docs.docker.com/trusted-content/dvp-program/ https://docs.docker.com/trusted-content/dvp-program/ Explains perks and Docker Hub analytics features, but doesn't explain requirements. It does link to ... [2] https://www.docker.com/partners/programs/ https://www.docker.com/partners/programs/ a sign up page that entices you to fill out a contact form if you want to learn more. And links to 2 new pages (and [1]) at the bottom: [3] https://www.docker.com/press-release/docker-expands-trusted-content-offerings/ https://www.docker.com/press-release/docker-expands-trusted-... the first of which is a press release explaining the value of the program. [4] https://www.docker.com/blog/docker-verified-publisher-trusted-sources-trusted-content/ https://www.docker.com/blog/docker-verified-publisher-truste... The second is this blog post which highlights trust and again Docker Hub features (e.g. rate limit removal, metrics, badging) and links back to [2] for more details. The third link is [1]. So, I'm still left curious about the grandparent comment's questions. It seems these pages are sparse on what the verification process looks like and if it might just be a "pay to play" relationship.

amouat 3y ago

I did a short YouTube version of the announcement: https://www.youtube.com/watch?v=QuyBWDx21d0 https://www.youtube.com/watch?v=QuyBWDx21d0

deleted 3y ago

[deleted]

KyleSanderson 3y ago

so... FROM:scratch ? Might be worthwhile restating the companies business model in announcements like this, especially for people unfamiliar with the area. This sounded like some wireguard thing from the name, only to discover it's just an org delivering statically linked binaries in a scratch docker image to defeat scanners...

dlor 3y ago
There's no defeating of scanners or even static linking. It's all automation, dynamic linking and patching to make the scanners happy. We go to great lengths to make sure that the scanners actually find everything so the results are accurate.
amouat 3y ago
Sort of. A few things though: - we don't use scratch. Our base image is chainguard/static which includes certs and a few other things typically needed by apps. - we have our own Linux distribution called Wolfi - we don't "defeat scanners". We work with scanners and publish security advisories. They recognise Wolfi. You can definitely find some images of ours that have CVEs (especially if you have an old image lying around).

tuananh 3y ago

lots of questions here regarding what this product is. I guess i can provide some information for the context, from a perspective of an outside contributor. Chainguard Images is a set of hardened container images. They were built by the original team that brought you Google's Distroless (https://github.com/GoogleContainerTools/distroless https://github.com/GoogleContainerTools/distroless) However, there were few problems with Distroless: 1. distroless were based on Debian - which in turn, limited to Debian's release cadence for fixing CVE. 2. distroless is using bazelbuild, which is not exactly easy to contrib, customize, etc... 3. distroless images are hard to extend. Chainguard built a new "undistro" OS for container workload, named Wolfi, using their OSS projects like melange (for packaging pkgs) and apko (for building images). The idea is (from my understanding) is that 1. You don't have to rely on upstream to cut a release. Chainguard will be doing that, with lots of automation & guardrails in placed. This allow them to fix vulnerabilties extremely fast. Why go through all the analysis, etc.. where you can patch it very quickly. 2. The OS is glibc-based. Which is a lot more friendly than Alpine. 3. It's pretty much YAML which is kinda easy to package software into APK packages & then images (with apko) 4. SBOM and a lot more. But that's stuff on top of my head.

tuananh 3y ago
Wolfi OS: https://github.com/wolfi-dev/os https://github.com/wolfi-dev/os melange (for packaging software): https://github.com/chainguard-dev/melange https://github.com/chainguard-dev/melange apko (for building image): https://github.com/chainguard-dev/apko https://github.com/chainguard-dev/apko

NovemberWhiskey 3y ago

It would be awesome if the Wolfi base image integrated nicely with Clair at some point too! I think someone was working on that last year but seems like it stalled.

kapilvt 3y ago

I'm excited to see this. One of my reservations on using chain guard images previously was how they only hosted them on their own registry, which had previously yanked access behind a pay wall for using any tag other then latest. At least with this wolfi images (nominally an oss project) won't be locked in a commercial registry vs a defacto public registry.