# compiler hardening

Published articles for compiler hardening.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Mitigating a rsync Vulnerability: A Lesson in Compiler Hardening

DevFeed: [Mitigating a rsync Vulnerability: A Lesson in Compiler Hardening](<https://devfeed.tech/articles/mitigating-a-rsync-vulnerability-a-lesson-in-compiler-hardening-13161.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/mitigating-a-rsync-vulnerability-a-lesson-in-compiler-hardening>)

Published: 2025-03-19T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Compiler](<https://devfeed.tech/topics/compiler.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Security](<https://devfeed.tech/topics/security.md>), [c/c++](<https://devfeed.tech/topics/c-c-plus-plus.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>)

Tags: [c](<https://devfeed.tech/tags/c.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [compiler-flags](<https://devfeed.tech/tags/compiler-flags.md>), [compiler-hardening](<https://devfeed.tech/tags/compiler-hardening.md>), [cves](<https://devfeed.tech/tags/cves.md>), [defense-in-depth](<https://devfeed.tech/tags/defense-in-depth.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [linux](<https://devfeed.tech/tags/linux.md>), [llvm](<https://devfeed.tech/tags/llvm.md>), [product-security](<https://devfeed.tech/tags/product-security.md>), [rsync](<https://devfeed.tech/tags/rsync.md>), [security](<https://devfeed.tech/tags/security.md>), [x86-64](<https://devfeed.tech/tags/x86-64.md>)

### AI overview

Chainguard describes how compiler hardening in its C/C++ toolchain helped protect against an rsync vulnerability before public disclosure. The article presents compiler hardening flags as layers of defense for memory-unsafe software and discusses Chainguard's implementation of recommendations from OpenSSF and GCC.

### Source excerpt

Chainguard's defense-in-depth security strategy protected against multiple rsync CVEs before they were even reported. See how we did it, using compiler flags.

## Enhanced Compiler Flags for Building Chainguard's Guarded Images

DevFeed: [Enhanced Compiler Flags for Building Chainguard's Guarded Images](<https://devfeed.tech/articles/enhanced-compiler-flags-for-building-chainguard-s-guarded-images-13030.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/enhanced-compiler-flags-for-building-chainguards-guarded-images>)

Published: 2024-11-19T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [c/c++](<https://devfeed.tech/topics/c-c-plus-plus.md>), [Security](<https://devfeed.tech/topics/security.md>), [Compiler](<https://devfeed.tech/topics/compiler.md>), [Memory Safety](<https://devfeed.tech/topics/memory-safety.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>)

Tags: [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [compiler](<https://devfeed.tech/tags/compiler.md>), [compiler-flags](<https://devfeed.tech/tags/compiler-flags.md>), [compiler-hardening](<https://devfeed.tech/tags/compiler-hardening.md>), [memory-safety](<https://devfeed.tech/tags/memory-safety.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

Chainguard Images now use enhanced compiler flags for C/C++ projects. The OpenSSF-recommended hardening is implemented through clang configuration files and gcc spec files in Wolfi, helping mitigate memory-safety vulnerabilities such as stack-based buffer overflows and unsafe memory usage.

### Source excerpt

Chainguard Images are now built using enhanced compiler flags for C/C++ projects. See how this strengthens the security posture of Chainguard's build systems.

## Chainguard Image now available for Postgres

DevFeed: [Chainguard Image now available for Postgres](<https://devfeed.tech/articles/chainguard-image-now-available-for-postgres-12949.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-image-now-available-for-postgres>)

Published: 2023-03-06T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [Databases](<https://devfeed.tech/topics/databases.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Security](<https://devfeed.tech/topics/security.md>), [vulnerability scanning](<https://devfeed.tech/topics/vulnerability-scanning.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [compiler-hardening](<https://devfeed.tech/tags/compiler-hardening.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [cosign](<https://devfeed.tech/tags/cosign.md>), [cves](<https://devfeed.tech/tags/cves.md>), [database-hardened-image](<https://devfeed.tech/tags/database-hardened-image.md>), [hardened-container-image](<https://devfeed.tech/tags/hardened-container-image.md>), [memory](<https://devfeed.tech/tags/memory.md>), [memory-safety](<https://devfeed.tech/tags/memory-safety.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [postgres](<https://devfeed.tech/tags/postgres.md>), [postgres-image](<https://devfeed.tech/tags/postgres-image.md>), [relational-database-image](<https://devfeed.tech/tags/relational-database-image.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [secure-database-image](<https://devfeed.tech/tags/secure-database-image.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [sql-database-image](<https://devfeed.tech/tags/sql-database-image.md>), [wolfi](<https://devfeed.tech/tags/wolfi.md>)

### AI overview

Chainguard announces a hardened Postgres container image built on Wolfi. The image runs as a non-root user, is built from source with compiler hardening and memory safety features, is 43MB in size, and aims to reduce known CVEs. It also includes SBOMs and provenance information to support vulnerability scanning and license compliance.

### Source excerpt

Run Postgres, now available as a Chainguard Image, as a hardened container image built on Wolfi. Secure Postgres images by default and reduce their size by 90%.