# apko Published articles for apko. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Introducing Chainguard OS Packages: Secure ingredients for custom container builds DevFeed: [Introducing Chainguard OS Packages: Secure ingredients for custom container builds]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard os](), [container images](), [Docker Hardened Images](), [Vulnerabilities](), [Linux](), [Automation](), [Dockerfile](), [Open Source](), [bazel](), [chainguard sboms](), [APK]() Tags: [apk](), [apko](), [automation](), [base-images](), [bazel](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [chainguard-os](), [chainguard-os-packages](), [chainguard-packages](), [chainguard-sboms](), [container](), [container-images](), [cve](), [dockerfiles](), [open-source](), [sboms](), [secure-software-packages](), [software-packages](), [vulnerabilities](), [zero-cve-packages]() ### AI overview Chainguard introduces Chainguard OS Packages, a service providing continuously maintained, enterprise-grade packages and base images for teams that build custom container images. Customers retain control over image composition and build tooling while Chainguard handles package sourcing, rebuilding, vulnerability remediation, and SBOM generation. ### Source excerpt Chainguard OS Packages are enterprise-grade, zero-CVE packages and base images built and continuously maintained in the Chainguard Factory. ## Reimagining the Linux distro with Wolfi DevFeed: [Reimagining the Linux distro with Wolfi]() Original publisher: [Read original article]() Published: 2024-02-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Linux](), [chainguard](), [container-security](), [Security](), [Package Management](), [APK](), [Open Source]() Tags: [apk](), [apko](), [chainguard](), [chainguard-images](), [container-security](), [cve](), [linux](), [melange](), [open-source](), [package-management](), [secure-container-images](), [security](), [vulnerabilities](), [wolfi]() ### AI overview The article explains why Chainguard created Wolfi, a minimal Linux distribution designed for modern container use. It describes the roles of Melange for building APK packages and Apko for assembling reproducible container images, along with Wolfi's security advisory and vulnerability-management capabilities. ### Source excerpt Discover Wolfi: Chainguard's answer to modern container security, creating minimal, secure Linux distributions for today's needs. ## Wolfi's approach to container security and CVE management DevFeed: [Wolfi's approach to container security and CVE management]() Original publisher: [Read original article]() Published: 2024-02-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container-security](), [Containers](), [open-source-security](), [Security](), [Open Source]() Tags: [apko](), [container-security](), [cve](), [cve-management](), [melange](), [oci](), [secure-images](), [secure-software-supply-chain](), [security](), [software-supply-chain](), [wolfi]() ### AI overview The article explains how Wolfi, a secure-by-default undistro, supports container security by helping create minimal, reproducible OCI-compliant images and reducing software supply chain risks. It also describes how Wolfi powers Chainguard Images. ### Source excerpt Discover Wolfi, the 'secure-by-default' undistro for container security, enhancing open-source software with minimal CVE counts and robust protection. ## How Chainguard protects against "Leaky Vessel" container escape vulnerabilities DevFeed: [How Chainguard protects against "Leaky Vessel" container escape vulnerabilities]() Original publisher: [Read original article]() Published: 2024-02-01T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [container-security](), [chainguard images](), [container images]() Tags: [apko](), [chainguard](), [container-escape](), [container-images](), [container-security](), [docker](), [docker-image](), [leaky-vessel](), [patches](), [runc](), [secure-by-default](), [upgrade]() ### AI overview This article explains the "Leaky Vessel" vulnerabilities affecting runc and BuildKit, including risks of container escape, host filesystem access, and elevated privileges. It describes how Chainguard Images use apko instead of runc or BuildKit and recommends upgrading to patched versions. ### Source excerpt Chainguard's response to 'Leaky Vessel' vulnerabilities: safeguarding container images with innovative, secure-by-default build processes. ## Images as Code: The pursuit of declarative image builds DevFeed: [Images as Code: The pursuit of declarative image builds]() Original publisher: [Read original article]() Published: 2024-01-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Code](), [chainguard images](), [Dockerfile](), [bazel](), [distroless](), [Docker](), [Containers](), [Kubernetes](), [Terraform](), [Infrastructure as code](), [Open Source]() Tags: [apk](), [apko](), [bazel](), [chainguard](), [chainguard-images](), [code](), [container-image](), [containers](), [declarative](), [distroless](), [docker](), [infrastructure-as-code](), [kubernetes](), [open-source](), [reproducibility](), [terraform]() ### AI overview The article traces the pursuit of declarative container image builds. It critiques imperative Dockerfile-based builds for making multi-tenant, multi-architecture, and reproducible builds difficult, then discusses Bazel and distroless images as steps toward expressing intended build state. Kubernetes and Terraform are presented as examples of declarative systems, inspiring the idea of "Images as Code." ### Source excerpt Chainguard's CTO Matt Moore describes the process of creating a declarative container image build for Chainguard Images. ## Wolfi: a new paradigm in Linux for containers DevFeed: [Wolfi: a new paradigm in Linux for containers]() Original publisher: [Read original article]() Published: 2024-01-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Linux](), [Containers](), [Package Management](), [container images](), [Security]() Tags: [apk](), [apko](), [chainguard](), [chainguard-images](), [containers](), [linux](), [melange](), [package-management](), [security](), [wolfi]() ### AI overview Wolfi is a minimal Linux distribution designed for containerized applications. The article describes its focus on efficiency, security, rapid updates, reproducible APK-based package management, and container image creation through melange and apko. ### Source excerpt Wolfi is a Linux distribution built specifically for containerized applications. See how it can speed up your development process. ## Building minimal, up-to-date cloud images with Wolfi DevFeed: [Building minimal, up-to-date cloud images with Wolfi]() Original publisher: [Read original article]() Published: 2023-12-15T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Cloud](), [container images](), [supply-chain-security](), [Open Source](), [Tooling](), [DevOps]() Tags: [apk](), [apko](), [architecture](), [chainguard-academy](), [cloud](), [common-vulnerabilities-and-exposures](), [container](), [container-images](), [devops](), [efficiency](), [kubecon-na](), [melange](), [minimalism](), [open-source](), [os](), [packages](), [security](), [software-supply-chain-security](), [supply-chain-security](), [vulnerabilities](), [wolfi]() ### AI overview The article introduces Wolfi, an open source project for building minimal, up-to-date cloud and container images. It explains how Wolfi's security-first architecture, proactive updates, minimalism, and supporting tools such as melange, apko, and apk help reduce attack surfaces and CVE exposure while improving software supply chain security. ### Source excerpt Discover Wolfi OS: Crafting minimal, always up-to-date cloud images for superior security and efficiency in the cloud. ## Announcing Bazel rules for extending Chainguard Images DevFeed: [Announcing Bazel rules for extending Chainguard Images]() Original publisher: [Read original article]() Published: 2023-10-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [supply-chain-security](), [container images](), [distroless](), [Package manager](), [Open Source]() Tags: [apk](), [apko](), [bazel](), [chainguard](), [chainguard-images](), [distroless](), [sbom](), [secure-software](), [secure-software-supply-chain](), [wolfi]() ### AI overview Chainguard and Aspect.Dev announce the general availability of rules_apko, an open source Bazel plugin for building secure, minimal Wolfi-based OCI container images. The article explains how rules_apko integrates APK packages and Wolfi-base images into existing Bazel workflows, supports reproducible builds, and provides dependency locking, integrity verification, and SBOM generation. ### Source excerpt Explore Bazel rules for Chainguard Images, your pathway to secure, effortless image extension. ## Small octopus and a big idea: The story of how a one-year old Linux un-distro is improving the cloud's software supply chain DevFeed: [Small octopus and a big idea: The story of how a one-year old Linux un-distro is improving the cloud's software supply chain]() Original publisher: [Read original article]() Published: 2023-09-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Linux](), [supply-chain-security](), [Cloud Native Ecosystem](), [Open Source](), [GitHub Actions](), [vulnerability]() Tags: [apko](), [chainguard-images](), [cloud-native](), [containers](), [github-actions](), [linux](), [melange](), [open-source](), [software-supply-chain](), [software-supply-chain-security](), [vulnerability](), [wolfi]() ### AI overview Chainguard reviews Wolfi's first year as a minimal Linux un-distro focused on rapid package updates, fast CVE remediation, and cloud-native software supply chain security. The article reports package, repository, contributor, update-interval, and vulnerability-scanning milestones, and describes Wolfi's rolling-release approach and wolfi-act integration with GitHub Actions. ### Source excerpt Explore Wolfi's journey: A Linux un-distro revolutionizing cloud-native development with agile updates for robust software security. ## How to use Dockerfiles with wolfi-base images DevFeed: [How to use Dockerfiles with wolfi-base images]() Original publisher: [Read original article]() Published: 2023-09-14T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [Dockerfile](), [Docker](), [chainguard images](), [distroless](), [container images](), [Linux](), [Go]() Tags: [apko](), [base-images](), [chainguard-images](), [container-images](), [distroless](), [docker](), [docker-hub](), [dockerfiles](), [go](), [guide](), [how-to](), [melange](), [wolfi]() ### AI overview This tutorial explains how to use Dockerfiles with Chainguard wolfi-base and other Chainguard Images. It covers minimal static images, glibc-dynamic images, multi-stage builds, package management, and selecting image variants based on application dependencies and runtime needs. ### Source excerpt Your guide to leveraging Dockerfiles with Wolfi-base images for hardened container images. ## Reproducing Chainguard's reproducible image builds DevFeed: [Reproducing Chainguard's reproducible image builds]() Original publisher: [Read original article]() Published: 2023-07-05T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [supply-chain-security](), [configuration](), [Tooling]() Tags: [apko](), [attestation](), [build](), [chainguard](), [chainguard-images](), [configuration](), [cosign](), [hardened-images](), [locks](), [reproducibility](), [reproducible-builds](), [secure-image](), [security](), [software-supply-chain](), [supply-chain-security](), [wolfi]() ### AI overview A tutorial explaining how to reproduce a Chainguard Images build using cosign and apko. It describes locking image configurations and notes caveats involving tooling changes and withdrawn packages. ### Source excerpt Learn how to reproduce a Chainguard Images build using cosign and apko. ## Chainguard Image now available for Pulumi DevFeed: [Chainguard Image now available for Pulumi]() Original publisher: [Read original article]() Published: 2023-06-29T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [pulumi](), [Infrastructure as code](), [container images](), [Security]() Tags: [apko](), [container-images](), [iac](), [multi-arch](), [pulumi](), [security](), [trivy](), [wolfi](), [x86-64]() ### AI overview Chainguard announces a Pulumi container image packaged with the Pulumi toolchain in Wolfi OS and built using apko. The image supports multiple programming-language runtimes, is multi-architecture, and is reported to be smaller and to have fewer Trivy-reported CVEs than the official Pulumi image. ### Source excerpt See a 57% reduction in your Pulumi image sizes with more security built in by default and a 97% reduction in CVEs with the new Chainguard Pulumi Image. ## apko: a year later DevFeed: [apko: a year later]() Original publisher: [Read original article]() Published: 2023-02-28T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Development](), [Package manager](), [supply-chain-security](), [chainguard images](), [Unix](), [YAML](), [Terraform]() Tags: [alpine](), [apk](), [apko](), [chainguard](), [chainguard-enforce](), [chainguard-images](), [cloud-native](), [development](), [distroless](), [golang](), [linux](), [macos](), [melange](), [secure-software-supply-chain](), [terraform-provider](), [wolfi](), [yaml]() ### AI overview This article reviews apko one year after its public release. It describes apko's native Go implementation of the apk package manager, which runs on UNIX-like systems including macOS and BSDs, and explains how its declarative YAML interface helped support an ecosystem that includes Chainguard Images, Melange, Wolfi, and a Terraform provider. The article presents apko as a foundation for secure software supply chains through images-as-code and frequent image rebuilds. ### Source excerpt Dive in to apko and learn more about the project; where it's been in the past year, and where it's going. ## Make SBOMs, not GuessBOMs: Why we need to shift left on SBOM generation DevFeed: [Make SBOMs, not GuessBOMs: Why we need to shift left on SBOM generation]() Original publisher: [Read original article]() Published: 2023-01-26T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [software bill of materials](), [supply-chain-security](), [software dark matter](), [vulnerability management](), [Reverse Engineering](), [Containers]() Tags: [apko](), [chainguard-images](), [container-security](), [guessbom](), [melange](), [reverse-engineering](), [sbom](), [sboms](), [sca](), [shift-left](), [software-composition-analysis](), [software-dark-matter](), [software-supply-chain](), [vulnerability]() ### AI overview The article argues that SBOMs generated after a build by software composition analysis tools can be incomplete because they may miss components that bypass recorded metadata, such as files copied through Dockerfiles. It presents build-time generation as a better way to produce complete SBOMs and describes untracked files as software dark matter, which can make post-build SBOMs closer to best guesses than reliable inventories. ### Source excerpt GuessBOMs, SBOMs generated by reverse-engineering software artifacts, have severe limitations. The optimal point for generating complete SBOMs is at build time.