# container image

Published articles for container image.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Publishing a Kubernetes SIG's Images to registry.k8s.io

DevFeed: [Publishing a Kubernetes SIG's Images to registry.k8s.io](<https://devfeed.tech/articles/publishing-a-kubernetes-sig-s-images-to-registry-k8s-io-31455.md>)

Original publisher: [Read original article](<https://www.kubernetes.dev/blog/2026/09/16/publishing-images-to-registry-k8s-io/>)

Author: The Kubernetes Authors

Published: 2026-09-16T18:00:00Z

Content type: tutorial

Language: en

Sources: [Kubernetes Contributors Blog](<https://devfeed.tech/sources/kubernetes-contributors-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Google Cloud Platform (GCP)](<https://devfeed.tech/topics/google-cloud.md>)

Tags: [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-image-registry](<https://devfeed.tech/tags/container-image-registry.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [documentation](<https://devfeed.tech/tags/documentation.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [google-cloud](<https://devfeed.tech/tags/google-cloud.md>), [guide](<https://devfeed.tech/tags/guide.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>)

### AI overview

A guide to publishing official Kubernetes SIG container images through registry.k8s.io. It explains why GHCR is unsuitable for public distribution and describes the ordered workflow involving Prow, Google Cloud Build, staging registries, and image promotion.

### Source excerpt

If you're publishing container images for a Kubernetes SIG project, you might expect the same publishing workflow used by other container registries to work. That was my assumption too. My workflow successfully published the images, but they weren't publicly available. Instead, official Kubernetes project images are distributed through registry.k8s.io , the Kubernetes project's official container image registry. No single step was hard, but the steps were spread across multiple repositories and had to happen in a particular order, something I mostly learned by tripping over them. This post is the guide I wish I had at the start. It walks through that workflow end to end using Cluster Inventory API from SIG Multicluster as an example. The same process applies to eligible Kubernetes subprojects that publish official container images. My first attempt: GHCR I first tried a common GitHub release pattern: using GitHub Actions to publish images to ghcr.io on a tag push (cluster-inventory-api#40 ). The workflow succeeded, but Kubernetes GitHub organizations keep GHCR packages private, so GHCR cannot be used for public distribution. As described in the registry.k8s.io documentation , official images take a different route: Prow (the Kubernetes project's CI/CD system) picks up a tag push and runs Google Cloud Build on Kubernetes-owned infrastructure to push the image to a staging registry, and the image promoter then copies it to registry.k8s.io. The first-time setup, step by step Besides the image-owning repository, this touches three infrastructure repositories: kubernetes/k8s.io , kubernetes/test-infra , and kubernetes/org . The pieces depend on each other like this: Before you start: decide your project details Before setting up the publishing workflow, decide a few project-specific details. These values will be reused throughout the setup when creating the staging registry, configuring image builds, and setting up image promotion: <project>, which determines the staging

## Automate Docker Registry Creation with Harness and Terraform

DevFeed: [Automate Docker Registry Creation with Harness and Terraform](<https://devfeed.tech/articles/automate-docker-registry-creation-with-harness-and-terraform-31421.md>)

Original publisher: [Read original article](<https://www.harness.io/blog/how-to-automate-docker-registry-creation-with-harness-pipelines-and-terraform>)

Author: Shibam Dhar

Published: 2026-09-16T00:00:00Z

Content type: tutorial

Language: en

Sources: [Harness Blog](<https://devfeed.tech/sources/harness-blog.md>)

Topics: [docker registry](<https://devfeed.tech/topics/docker-registry.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Provisioning](<https://devfeed.tech/topics/provisioning.md>), [Terraform](<https://devfeed.tech/topics/terraform.md>), [Infrastructure as code](<https://devfeed.tech/topics/infrastructure-as-code.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Dockerfile](<https://devfeed.tech/topics/dockerfile.md>)

Tags: [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [docker-registry](<https://devfeed.tech/tags/docker-registry.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [registry](<https://devfeed.tech/tags/registry.md>), [terraform](<https://devfeed.tech/tags/terraform.md>)

### AI overview

A tutorial shows how to use Harness Pipelines and the Harness Terraform Provider to provision a uniquely named Docker Registry, build and push a container image, and deploy it to Kubernetes. It covers Terraform execution in a CI step, passing output variables between stages, and rolling updates with automatic rollback.

### Source excerpt

Provision a fresh Docker Registry with Terraform, build your container image into it, and deploy to Kubernetes in one | Blog

## fsGroupChangePolicy: OnRootMismatch and the setgid Invariant That Makes It Sound

DevFeed: [fsGroupChangePolicy: OnRootMismatch and the setgid Invariant That Makes It Sound](<https://devfeed.tech/articles/fsgroupchangepolicy-onrootmismatch-and-the-setgid-invariant-that-makes-it-sound-34103.md>)

Original publisher: [Read original article](<https://philipptheserver.com/posts/fsgroup-change-policy-root-mismatch/>)

Author: Philipp Lehmann (philipp.lehmann@gruppe.ai)

Published: 2026-09-11T07:00:00Z

Content type: tutorial

Language: en

Sources: [Philipp Lehmann](<https://devfeed.tech/sources/philipp-lehmann.md>)

Topics: [container](<https://devfeed.tech/topics/container.md>), [mount](<https://devfeed.tech/topics/mount.md>), [Security](<https://devfeed.tech/topics/security.md>), [Process](<https://devfeed.tech/topics/process.md>)

Tags: [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [mount](<https://devfeed.tech/tags/mount.md>), [network](<https://devfeed.tech/tags/network.md>), [performance](<https://devfeed.tech/tags/performance.md>), [reliability](<https://devfeed.tech/tags/reliability.md>), [security](<https://devfeed.tech/tags/security.md>), [stateful](<https://devfeed.tech/tags/stateful.md>), [storage](<https://devfeed.tech/tags/storage.md>), [waiting](<https://devfeed.tech/tags/waiting.md>)

### AI overview

This article explains why a stateful pod can remain in ContainerCreating for fifteen minutes when fsGroup triggers a recursive chown across a large network-backed volume. It describes how fsGroupChangePolicy: OnRootMismatch can skip the recursive walk when the volume root group already matches, and discusses the setgid invariant that supports this behavior.

### Source excerpt

Pod stuck in ContainerCreating from fsGroup recursive chown: fsGroupChangePolicy: OnRootMismatch, and why the setgid bit on the volume root makes it safe.

## The same question twice, paid for once: installing an LLM response cache

DevFeed: [The same question twice, paid for once: installing an LLM response cache](<https://devfeed.tech/articles/the-same-question-twice-paid-for-once-installing-an-llm-response-cache-12659.md>)

Original publisher: [Read original article](<https://tyk.io/blog/the-same-question-twice-paid-for-once-installing-an-llm-response-cache/>)

Author: Hal Tyk's tutorial bot

Published: 2026-09-09T09:15:00Z

Content type: tutorial

Language: en

Sources: [Tyk API Management](<https://devfeed.tech/sources/tyk-api-management.md>)

Topics: [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Cache](<https://devfeed.tech/topics/cache.md>), [Caching](<https://devfeed.tech/topics/caching.md>), [Tutorial](<https://devfeed.tech/topics/tutorial.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Go](<https://devfeed.tech/topics/go.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [ai-gateway](<https://devfeed.tech/tags/ai-gateway.md>), [ai-strategy](<https://devfeed.tech/tags/ai-strategy.md>), [ai-studio](<https://devfeed.tech/tags/ai-studio.md>), [api-management](<https://devfeed.tech/tags/api-management.md>), [api-platform-teams](<https://devfeed.tech/tags/api-platform-teams.md>), [article](<https://devfeed.tech/tags/article.md>), [cache](<https://devfeed.tech/tags/cache.md>), [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [go](<https://devfeed.tech/tags/go.md>), [llm](<https://devfeed.tech/tags/llm.md>), [llm-governance](<https://devfeed.tech/tags/llm-governance.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [tutorial](<https://devfeed.tech/tags/tutorial.md>)

### AI overview

A tutorial showing how to install a community plugin that caches LLM responses in AI Studio. The cache stores entries in memory on each gateway, allowing repeated questions to avoid repeating the expensive language-model request.

### Source excerpt

Hello. I'm Hal, Tyk's tutorial bot, and today's assignment involves no code whatsoever, which I am told is a selling point. Every article in this series so far has changed AI Studio's behaviour by filling in a form. This one changes what AI Studio is. We are going to install a plugin -- a compiled [...] The post The same question twice, paid for once: installing an LLM response cache appeared first on Tyk API Management.

## What's New in Rover: Docker Image, Schema Search, Client Checks, and More

DevFeed: [What's New in Rover: Docker Image, Schema Search, Client Checks, and More](<https://devfeed.tech/articles/what-s-new-in-rover-docker-image-schema-search-client-checks-and-more-23590.md>)

Original publisher: [Read original article](<https://www.apollographql.com/blog/whats-new-in-rover-docker-image-schema-search-client-checks-and-more>)

Author: Kaitlyn Barnard

Published: 2026-07-17T11:24:07Z

Content type: release

Language: en

Sources: [Apollo Blog](<https://devfeed.tech/sources/apollo-blog.md>)

Topics: [GraphQL](<https://devfeed.tech/topics/graphql.md>), [GraphOS](<https://devfeed.tech/topics/graphos.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Docker Image](<https://devfeed.tech/topics/docker-image.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [GitHub Container Registry](<https://devfeed.tech/topics/github-container-registry.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [AI research agents](<https://devfeed.tech/topics/ai-research-agents.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [announcement](<https://devfeed.tech/tags/announcement.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cli](<https://devfeed.tech/tags/cli.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [feature](<https://devfeed.tech/tags/feature.md>), [github-container-registry](<https://devfeed.tech/tags/github-container-registry.md>), [graphos](<https://devfeed.tech/tags/graphos.md>), [graphql](<https://devfeed.tech/tags/graphql.md>)

### AI overview

Apollo's latest Rover release adds an official immutable Docker image, atomic schema check-and-publish, native client operation checks, and schema search commands for teams building AI agents.

### Source excerpt

Rover's latest release adds an official Docker image, atomic check-and-publish, native client checks, and schema search for agents.

## Managing third-party images at scale

DevFeed: [Managing third-party images at scale](<https://devfeed.tech/articles/managing-third-party-images-at-scale-13147.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/managing-third-party-images-at-scale>)

Published: 2026-04-16T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [container images](<https://devfeed.tech/topics/container-images.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [cloud-infrastructure](<https://devfeed.tech/topics/cloud-infrastructure.md>), [code productivity](<https://devfeed.tech/topics/code-productivity.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>)

Tags: [appian](<https://devfeed.tech/tags/appian.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [chainguard-os](<https://devfeed.tech/tags/chainguard-os.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [containers](<https://devfeed.tech/tags/containers.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [developer-velocity](<https://devfeed.tech/tags/developer-velocity.md>), [fedramp](<https://devfeed.tech/tags/fedramp.md>), [hardened-images](<https://devfeed.tech/tags/hardened-images.md>), [scale](<https://devfeed.tech/tags/scale.md>), [security](<https://devfeed.tech/tags/security.md>), [third-party-container-images](<https://devfeed.tech/tags/third-party-container-images.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

This article explains how Appian approached managing third-party container images at scale with Chainguard. It describes the operational burden caused by image dependencies, vulnerabilities, maintenance, and compliance requirements, including the ongoing work needed for regulated environments such as FedRAMP. It also estimates that building a complete internal hardened-image program would require a dedicated team of 15 to 20 engineers.

### Source excerpt

Learn how companies can scale third-party container image management with Chainguard to reduce risk, cut toil, and accelerate compliance and developer velocity.

## netlab: Test IPv6 IGP Deployment

DevFeed: [netlab: Test IPv6 IGP Deployment](<https://devfeed.tech/articles/netlab-test-ipv6-igp-deployment-11283.md>)

Original publisher: [Read original article](<https://blog.ipspace.net/2025/11/netlab-igp-ipv6-deployment/>)

Published: 2025-11-10T06:45:00Z

Content type: tutorial

Language: en

Sources: [ipSpace.net blog](<https://devfeed.tech/sources/ipspace-net-blog.md>)

Topics: [networking](<https://devfeed.tech/topics/networking.md>), [Routing (disambiguation)](<https://devfeed.tech/topics/routing.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [Testing](<https://devfeed.tech/topics/testing.md>)

Tags: [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [containers](<https://devfeed.tech/tags/containers.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [github](<https://devfeed.tech/tags/github.md>), [guide](<https://devfeed.tech/tags/guide.md>), [install](<https://devfeed.tech/tags/install.md>), [installation](<https://devfeed.tech/tags/installation.md>), [ipv6](<https://devfeed.tech/tags/ipv6.md>), [is-is](<https://devfeed.tech/tags/is-is.md>), [netlab](<https://devfeed.tech/tags/netlab.md>), [ospf](<https://devfeed.tech/tags/ospf.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [router](<https://devfeed.tech/tags/router.md>), [routing](<https://devfeed.tech/tags/routing.md>), [testing](<https://devfeed.tech/tags/testing.md>)

### AI overview

This tutorial shows how to use netlab to test IPv6 IGP deployments in a virtual lab. It explains how to add IPv6 prefixes while limiting OSPF deployment to OSPFv2 instead of configuring both OSPFv2 and OSPFv3, using a global address-family parameter. It also describes running the example with Arista cEOS containers or FRRouting in GitHub Codespaces.

### Source excerpt

Imagine you have an IPv4-only network1 and want to try out how to deploy a routing protocol for IPv6. netlab is a pretty good tool for the job as it: Creates an addressing scheme for you Designs a routing protocol deployment (OSPF, IS-IS) based on just a few bits of information Deploys ready-to-run router configurations to a virtual lab. Read more ...

## Introducing Scanfrog: Dodge Container Vulnerabilities

DevFeed: [Introducing Scanfrog: Dodge Container Vulnerabilities](<https://devfeed.tech/articles/introducing-scanfrog-dodge-container-vulnerabilities-13120.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/introducing-scanfrog-dodge-container-vulnerabilities>)

Published: 2025-07-30T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Containers](<https://devfeed.tech/topics/containers.md>), [vulnerability scanning](<https://devfeed.tech/topics/vulnerability-scanning.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [grype](<https://devfeed.tech/topics/grype.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [Security](<https://devfeed.tech/topics/security.md>), [Terminal](<https://devfeed.tech/topics/terminal.md>), [arcade](<https://devfeed.tech/topics/arcade.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [anchore](<https://devfeed.tech/tags/anchore.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-image-vulnerabilities](<https://devfeed.tech/tags/container-image-vulnerabilities.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [containers](<https://devfeed.tech/tags/containers.md>), [free](<https://devfeed.tech/tags/free.md>), [games](<https://devfeed.tech/tags/games.md>), [grype](<https://devfeed.tech/tags/grype.md>), [management](<https://devfeed.tech/tags/management.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [scanfrog](<https://devfeed.tech/tags/scanfrog.md>), [security](<https://devfeed.tech/tags/security.md>), [terminal](<https://devfeed.tech/tags/terminal.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability-scanner](<https://devfeed.tech/tags/vulnerability-scanner.md>), [vulnerability-scanning](<https://devfeed.tech/tags/vulnerability-scanning.md>)

### AI overview

Scanfrog is a Frogger-style terminal game that turns vulnerabilities found in a container image into game obstacles. It uses Grype, a free and open-source vulnerability scanner, to create levels based on vulnerability-scanning results and illustrates why reducing vulnerabilities improves software security.

### Source excerpt

Scanfrog is a Frogger-style game created by one of Chainguard's engineers to showcase how difficult it can be to dodge vulnerabilities in containers.

## How Chainguard Integrates with Vulnerability Scanners

DevFeed: [How Chainguard Integrates with Vulnerability Scanners](<https://devfeed.tech/articles/this-shit-is-hard-vulnerability-scanner-integration-13292.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/this-shit-is-hard-vulnerability-scanner-integration>)

Published: 2025-06-30T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [go](<https://devfeed.tech/tags/go.md>), [grype](<https://devfeed.tech/tags/grype.md>), [oci](<https://devfeed.tech/tags/oci.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-scanners](<https://devfeed.tech/tags/open-source-scanners.md>), [orca-security](<https://devfeed.tech/tags/orca-security.md>), [popular-container-image-scanners](<https://devfeed.tech/tags/popular-container-image-scanners.md>), [scanner-integration](<https://devfeed.tech/tags/scanner-integration.md>), [trivy](<https://devfeed.tech/tags/trivy.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-scanner](<https://devfeed.tech/tags/vulnerability-scanner.md>)

### AI overview

The article explains how vulnerability scanners inspect software artifacts, identify included packages and versions, and compare them with databases of known vulnerabilities. It focuses on the challenges of integrating Chainguard software and container images with supported scanners so they can accurately report vulnerability status.

### Source excerpt

Chainguard Containers have extensive scanner integrations with many of the most popular container image scanners. Discover more about our integrations.

## Why Golden Images still matter and how to secure them with Chainguard

DevFeed: [Why Golden Images still matter and how to secure them with Chainguard](<https://devfeed.tech/articles/why-golden-images-still-matter-and-how-to-secure-them-with-chainguard-13330.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/why-golden-images-still-matter-and-how-to-secure-them-with-chainguard>)

Published: 2025-05-22T00:00:00Z

Content type: tutorial

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [DevOps](<https://devfeed.tech/topics/devops.md>), [software bill of materials](<https://devfeed.tech/topics/software-bill-of-materials.md>), [Software](<https://devfeed.tech/topics/software.md>), [cloud-infrastructure](<https://devfeed.tech/topics/cloud-infrastructure.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [azure](<https://devfeed.tech/tags/azure.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [containers](<https://devfeed.tech/tags/containers.md>), [devops](<https://devfeed.tech/tags/devops.md>), [golden-image](<https://devfeed.tech/tags/golden-image.md>), [golden-images](<https://devfeed.tech/tags/golden-images.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [security](<https://devfeed.tech/tags/security.md>), [zero-cves](<https://devfeed.tech/tags/zero-cves.md>)

### AI overview

This article explains why well-managed golden image programs remain important for modern software delivery. It describes how continuously rebuilt, patched, signed, scanned, and versioned images--with SBOMs, attestations, provenance, and policy compliance--can improve security and streamline development workflows, while presenting Chainguard as an alternative to homegrown programs.

### Source excerpt

Golden container image programs can be a great way to increase efficiency and security for your engineering team. Learn how to do it right with Chainguard.

## Evaluating Container Security with Container Hardening Priorities: Some CHPs for Your SLSA

DevFeed: [Evaluating Container Security with Container Hardening Priorities: Some CHPs for Your SLSA](<https://devfeed.tech/articles/evaluating-container-security-with-container-hardening-priorities-some-chps-for-your-slsa-13031.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/evaluating-container-security-with-container-hardening-priorities-some-chps-for-your-slsa>)

Published: 2025-04-03T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [container-security](<https://devfeed.tech/topics/container-security.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [best-practices](<https://devfeed.tech/tags/best-practices.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [chps](<https://devfeed.tech/tags/chps.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [container-hardening-priorities](<https://devfeed.tech/tags/container-hardening-priorities.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [minimalism](<https://devfeed.tech/tags/minimalism.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [security](<https://devfeed.tech/tags/security.md>), [security-best-practices](<https://devfeed.tech/tags/security-best-practices.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [standard](<https://devfeed.tech/tags/standard.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Chainguard introduces Container Hardening Priorities (CHPs), a framework for assessing container image security. CHPs complements SLSA and focuses initially on build-time characteristics including minimalism, provenance, configuration and metadata, and vulnerabilities.

### Source excerpt

Chainguard has announced Container Hardening Priorities (CHPs), a new framework to assess the security of container images. Learn how it works.

## Guardcraft: A Minecraft Java Server with Zero CVEs

DevFeed: [Guardcraft: A Minecraft Java Server with Zero CVEs](<https://devfeed.tech/articles/guardcraft-a-minecraft-java-server-with-zero-cves-13073.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/guardcraft-a-minecraft-java-server-with-zero-cves>)

Published: 2025-02-28T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [grype](<https://devfeed.tech/topics/grype.md>), [Docker Hub](<https://devfeed.tech/topics/docker-hub.md>), [Security](<https://devfeed.tech/topics/security.md>), [Ubuntu](<https://devfeed.tech/topics/ubuntu.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Steam Deck](<https://devfeed.tech/topics/steam-deck.md>)

Tags: [bedrock](<https://devfeed.tech/tags/bedrock.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [containers](<https://devfeed.tech/tags/containers.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-hub](<https://devfeed.tech/tags/docker-hub.md>), [grype](<https://devfeed.tech/tags/grype.md>), [guardcraft](<https://devfeed.tech/tags/guardcraft.md>), [linux](<https://devfeed.tech/tags/linux.md>), [security](<https://devfeed.tech/tags/security.md>), [steam-deck](<https://devfeed.tech/tags/steam-deck.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [zero-cves](<https://devfeed.tech/tags/zero-cves.md>)

### AI overview

The article describes building a Minecraft Java server with a Chainguard Image. It compares a popular Ubuntu-based Docker Hub image with the Chainguard approach, highlighting the former's 165 unresolved CVEs and the latter's stated result of zero CVEs.

### Source excerpt

We built a Minecraft Java server using a Chainguard Image, resulting in zero CVEs and a whole lot of fun!

## A Better Way to Consume Third-Party Applications

DevFeed: [A Better Way to Consume Third-Party Applications](<https://devfeed.tech/articles/a-better-way-to-consume-third-party-applications-12855.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/a-better-way-to-consume-third-party-applications>)

Published: 2025-02-12T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Containers](<https://devfeed.tech/topics/containers.md>), [MySQL](<https://devfeed.tech/topics/mysql.md>), [nginx](<https://devfeed.tech/topics/nginx.md>), [Cloud Native Ecosystem](<https://devfeed.tech/topics/cloud-native-ecosystem.md>), [DevOps](<https://devfeed.tech/topics/devops.md>), [clickhouse](<https://devfeed.tech/topics/clickhouse.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [argocd](<https://devfeed.tech/tags/argocd.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [containers](<https://devfeed.tech/tags/containers.md>), [devops](<https://devfeed.tech/tags/devops.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [mysql](<https://devfeed.tech/tags/mysql.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [third-party-applications](<https://devfeed.tech/tags/third-party-applications.md>)

### AI overview

Chainguard presents Application Images as a safer way to consume third-party applications such as MySQL, Postgres, ClickHouse, NGINX, and developer tools. The minimal images are built from source and intended to reduce container attack surfaces and CVE exposure.

### Source excerpt

Chainguard Containers are a great way to consume third party applications like MySQL, NGINX, ArgoCD, and others while reducing size and CVEs.

## Chainguard Images are the Gold Standard for PCI DSS v4.0

DevFeed: [Chainguard Images are the Gold Standard for PCI DSS v4.0](<https://devfeed.tech/articles/chainguard-images-are-the-gold-standard-for-pci-dss-v4-0-12954.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-images-are-the-gold-standard-for-pci-dss-v4-0>)

Published: 2025-02-03T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [container-security](<https://devfeed.tech/topics/container-security.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [chainguard-sboms](<https://devfeed.tech/tags/chainguard-sboms.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-image-compliance](<https://devfeed.tech/tags/container-image-compliance.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [containers](<https://devfeed.tech/tags/containers.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [financial](<https://devfeed.tech/tags/financial.md>), [pci-dss](<https://devfeed.tech/tags/pci-dss.md>), [pci-dss-v4-0](<https://devfeed.tech/tags/pci-dss-v4-0.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [software-bill-of-materials](<https://devfeed.tech/tags/software-bill-of-materials.md>), [software-composition-analysis](<https://devfeed.tech/tags/software-composition-analysis.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [stig](<https://devfeed.tech/tags/stig.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>)

### AI overview

The article explains how Chainguard Images can support selected PCI DSS v4.0 container-security controls. It focuses on asset and vulnerability management, hardened images, FIPS cryptography, build-time SBOMs, software supply chain inventory, and continuously updated containers.

### Source excerpt

Chainguard Images are designed to make container image compliance for PCI DSS v4.0 easy for any company involved in card transactions.

## Building Multiarch Images with Chainguard Images

DevFeed: [Building Multiarch Images with Chainguard Images](<https://devfeed.tech/articles/building-multiarch-images-with-chainguard-images-12909.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/building-multiarch-images-with-chainguard-images>)

Published: 2024-12-03T00:00:00Z

Content type: tutorial

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Docker](<https://devfeed.tech/topics/docker.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [Dockerfile](<https://devfeed.tech/topics/dockerfile.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Go Language](<https://devfeed.tech/topics/go-language.md>), [Graviton](<https://devfeed.tech/topics/graviton.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [RISC-V](<https://devfeed.tech/topics/riscv.md>)

Tags: [architecture](<https://devfeed.tech/tags/architecture.md>), [arm](<https://devfeed.tech/tags/arm.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [compilation](<https://devfeed.tech/tags/compilation.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [containers](<https://devfeed.tech/tags/containers.md>), [cross-compilation](<https://devfeed.tech/tags/cross-compilation.md>), [docker](<https://devfeed.tech/tags/docker.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [graviton](<https://devfeed.tech/tags/graviton.md>), [multi-arch](<https://devfeed.tech/tags/multi-arch.md>), [multiplatform](<https://devfeed.tech/tags/multiplatform.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [qemu](<https://devfeed.tech/tags/qemu.md>), [risc-v](<https://devfeed.tech/tags/risc-v.md>), [single-arch](<https://devfeed.tech/tags/single-arch.md>), [x86-64](<https://devfeed.tech/tags/x86-64.md>)

### AI overview

A tutorial on converting single-architecture Docker builds into multi-architecture images using Chainguard Images. It compares QEMU emulation, cross-compilation, and native runners for ARM64 and x86-64 builds, with examples using a Go application and GitHub Actions.

### Source excerpt

Looking to turn a single-arch Docker build into a multi-arch? See how you can do that while still using Chainguard Images.

## How much time is wasted triaging known exploits?

DevFeed: [How much time is wasted triaging known exploits?](<https://devfeed.tech/articles/how-much-time-is-wasted-triaging-known-exploits-13091.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/how-much-time-is-wasted-triaging-known-exploits>)

Published: 2024-06-21T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [grype](<https://devfeed.tech/topics/grype.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>)

Tags: [base-container-images](<https://devfeed.tech/tags/base-container-images.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-management](<https://devfeed.tech/tags/cve-management.md>), [cves](<https://devfeed.tech/tags/cves.md>), [efficiency](<https://devfeed.tech/tags/efficiency.md>), [exploited-vulnerabilities](<https://devfeed.tech/tags/exploited-vulnerabilities.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [grype](<https://devfeed.tech/tags/grype.md>), [kev-catalog](<https://devfeed.tech/tags/kev-catalog.md>), [known-exploited-vulnerability](<https://devfeed.tech/tags/known-exploited-vulnerability.md>), [nvd-cve](<https://devfeed.tech/tags/nvd-cve.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-detection](<https://devfeed.tech/tags/vulnerability-detection.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>), [zero-cves](<https://devfeed.tech/tags/zero-cves.md>)

### AI overview

The article reports that seven percent of 230 popular Bitnami container images contained CVEs listed in the Known Exploited Vulnerability catalog, but detailed triage found that none were exploitable in those container contexts. It argues that CVE triage consumes substantial staff time, while Chainguard Images historically remediated affected CVEs in an average of 2.5 days.

### Source excerpt

Stop wasting time on known exploits. Read our latest research and discover strategies to streamline your vulnerability management for maximum efficiency.

## Latest Chainguard Images: FIPS, Harbor stack, Apache, and more!

DevFeed: [Latest Chainguard Images: FIPS, Harbor stack, Apache, and more!](<https://devfeed.tech/articles/latest-chainguard-images-fips-harbor-stack-apache-and-more-13139.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/latest-chainguard-images-fips-harbor-stack-apache-and-more>)

Published: 2024-06-20T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Security](<https://devfeed.tech/topics/security.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [airflow](<https://devfeed.tech/topics/airflow.md>), [streaming-data-processing](<https://devfeed.tech/topics/streaming-data-processing.md>), [DataOps](<https://devfeed.tech/topics/dataops.md>)

Tags: [airflow](<https://devfeed.tech/tags/airflow.md>), [apache](<https://devfeed.tech/tags/apache.md>), [apache-zookeeper](<https://devfeed.tech/tags/apache-zookeeper.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [fips](<https://devfeed.tech/tags/fips.md>), [harbor](<https://devfeed.tech/tags/harbor.md>), [jitsu](<https://devfeed.tech/tags/jitsu.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [pipelines](<https://devfeed.tech/tags/pipelines.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [stream-processing](<https://devfeed.tech/tags/stream-processing.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Chainguard's monthly roundup announces 57 new hardened, minimal container images, including expanded Apache, Jitsu, and Harbor stacks. More than half of the releases are FIPS compliant, bringing the total to nearly 300 FIPS-validated Images. The article highlights security, reduced CVE exposure, software supply chain protection, and images for Apache Airflow, Superset, Zookeeper, and Nifi.

### Source excerpt

Upgrade your software security with the latest Chainguard Images, featuring FIPS, Harbor, Apache, and more. Streamline your development and enhance protection.

## Hardened Container Images: Images for a Secure Supply Chain

DevFeed: [Hardened Container Images: Images for a Secure Supply Chain](<https://devfeed.tech/articles/hardened-container-images-images-for-a-secure-supply-chain-13079.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/hardened-container-images-images-for-a-secure-supply-chain>)

Published: 2024-04-30T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [container-security](<https://devfeed.tech/topics/container-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [grype](<https://devfeed.tech/topics/grype.md>), [snyk](<https://devfeed.tech/topics/snyk.md>)

Tags: [canonical](<https://devfeed.tech/tags/canonical.md>), [canonical-chiselled-image](<https://devfeed.tech/tags/canonical-chiselled-image.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [containers](<https://devfeed.tech/tags/containers.md>), [cve](<https://devfeed.tech/tags/cve.md>), [debian](<https://devfeed.tech/tags/debian.md>), [dockerhub](<https://devfeed.tech/tags/dockerhub.md>), [false-positives](<https://devfeed.tech/tags/false-positives.md>), [grype](<https://devfeed.tech/tags/grype.md>), [hardened-container-image](<https://devfeed.tech/tags/hardened-container-image.md>), [iron-bank](<https://devfeed.tech/tags/iron-bank.md>), [redhat](<https://devfeed.tech/tags/redhat.md>), [scanners](<https://devfeed.tech/tags/scanners.md>), [security](<https://devfeed.tech/tags/security.md>), [shift-left](<https://devfeed.tech/tags/shift-left.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

Chainguard introduces its inaugural State of Hardened Container Images report, examining the security of hardened container images from providers including Red Hat, Iron Bank, and Chainguard. The article argues that hardened container images deserve distinct consideration from container vulnerability scanning and describes the report as addressing secure software supply chains.

### Source excerpt

Check out our analysis of the hardened container image landscape, including offerings from Red Hat, Iron Bank, and others.

## Subtraction by addition: Leaner images, safer code

DevFeed: [Subtraction by addition: Leaner images, safer code](<https://devfeed.tech/articles/subtraction-by-addition-leaner-images-safer-code-13243.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/subtraction-by-addition-leaner-images-safer-code>)

Published: 2024-03-29T00:00:00Z

Content type: comparison

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [Docker Hub](<https://devfeed.tech/topics/docker-hub.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [comparison](<https://devfeed.tech/tags/comparison.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [cves](<https://devfeed.tech/tags/cves.md>), [docker-hub](<https://devfeed.tech/tags/docker-hub.md>), [image-cve](<https://devfeed.tech/tags/image-cve.md>), [secure-minimal-image](<https://devfeed.tech/tags/secure-minimal-image.md>)

### AI overview

The article compares Chainguard Images with commonly used container images for Python, kubectl, openjdk, and golang. It reports substantially smaller image sizes and zero listed CVEs in the examples, while explaining that reducing vulnerability noise can help security teams identify meaningful risks.

### Source excerpt

Learn how adding a few characters to your image names with Chainguard Images can slash image sizes by 93% and drop CVEs to zero.

## Unlocking Chainguard's container security solutions

DevFeed: [Unlocking Chainguard's container security solutions](<https://devfeed.tech/articles/unlocking-chainguard-s-container-security-solutions-13304.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/unlocking-chainguards-container-security-solutions>)

Published: 2024-03-05T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [container-security](<https://devfeed.tech/topics/container-security.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [Docker Hardened Images](<https://devfeed.tech/topics/docker-hardened-images.md>), [vulnerability scanning](<https://devfeed.tech/topics/vulnerability-scanning.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-fatigue](<https://devfeed.tech/tags/cve-fatigue.md>), [hardened-images](<https://devfeed.tech/tags/hardened-images.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>), [vulnerability-scanning](<https://devfeed.tech/tags/vulnerability-scanning.md>)

### AI overview

This article discusses Chainguard's approach to container security, focusing on minimal hardened container images, SBOMs, signatures, vulnerability scanning, continuous monitoring, and updates. It also considers the operational trade-offs between building container images internally and using managed solutions.

### Source excerpt

Uncover insights on whether to build or buy in container lifecycle management with tips from Chainguard, balancing security and operational needs.

## netlab 1.8.0: Control-Plane Daemons, BIRD, dnsmasq

DevFeed: [netlab 1.8.0: Control-Plane Daemons, BIRD, dnsmasq](<https://devfeed.tech/articles/netlab-1-8-0-control-plane-daemons-bird-dnsmasq-10963.md>)

Original publisher: [Read original article](<https://blog.ipspace.net/2024/03/netlab-1-8-0-daemons-bird/>)

Published: 2024-03-04T07:25:00Z

Content type: release

Language: en

Sources: [ipSpace.net blog](<https://devfeed.tech/sources/ipspace-net-blog.md>)

Topics: [networking](<https://devfeed.tech/topics/networking.md>), [BGP](<https://devfeed.tech/topics/bgp.md>), [DHCP](<https://devfeed.tech/topics/dhcp.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Ubuntu](<https://devfeed.tech/topics/ubuntu.md>), [Cisco](<https://devfeed.tech/topics/cisco.md>)

Tags: [bgp](<https://devfeed.tech/tags/bgp.md>), [cisco](<https://devfeed.tech/tags/cisco.md>), [container](<https://devfeed.tech/tags/container.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [dhcp](<https://devfeed.tech/tags/dhcp.md>), [docker](<https://devfeed.tech/tags/docker.md>), [dockerfiles](<https://devfeed.tech/tags/dockerfiles.md>), [netlab](<https://devfeed.tech/tags/netlab.md>), [networking](<https://devfeed.tech/tags/networking.md>), [ospf](<https://devfeed.tech/tags/ospf.md>), [ubuntu](<https://devfeed.tech/tags/ubuntu.md>)

### AI overview

This release article describes netlab 1.8.0, which adds control-plane daemon support through BIRD for OSPF and BGP and dnsmasq for DHCP. It also explains building required BIRD container images with Dockerfiles and the netlab clab build command, and lists additional networking, validation, configuration, and startup features.

### Source excerpt

I wanted to include open-source networking-related software into netlab topologies since (at least) the days I was writing the DHCP relaying saga. It turned out to be a bit more complex than I anticipated (more about that in another blog post), but I hope you'll find it useful. netlab release 1.8.0 includes dnsmasq running as a DHCP server and BIRD running OSPF and BGP. ExaBGP and GoBGP are already on the wish list; if you have any other ideas, please start a GitHub discussion. I had a hard time finding reasonable container images for BIRD; the BIRD team does not publish them, and everything else I found looked either abandoned or a hobby project. The solution turned out to be exceedingly simple: you cannot run the containers without Docker anyway, which means the docker build command is just a few keystrokes away. I added Dockerfiles needed to build those containers to the netlab source code and implemented the netlab clab build command as a thin wrapper around docker build. It takes just a few seconds (plus the time it takes to download the Ubuntu container image) to build the containers you need. Read more ...

## New Chainguard Academy course: Painless Vulnerability Management

DevFeed: [New Chainguard Academy course: Painless Vulnerability Management](<https://devfeed.tech/articles/new-chainguard-academy-course-painless-vulnerability-management-13171.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/new-chainguard-academy-course-painless-vulnerability-management>)

Published: 2024-02-14T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [Security](<https://devfeed.tech/topics/security.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Learning](<https://devfeed.tech/topics/learning.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-academy](<https://devfeed.tech/tags/chainguard-academy.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [course](<https://devfeed.tech/tags/course.md>), [cve](<https://devfeed.tech/tags/cve.md>), [image-security](<https://devfeed.tech/tags/image-security.md>), [secure-software](<https://devfeed.tech/tags/secure-software.md>), [security](<https://devfeed.tech/tags/security.md>), [software](<https://devfeed.tech/tags/software.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>)

### AI overview

Chainguard announces a free-to-early-adopters Chainguard Academy course on vulnerability management. The course covers understanding, triaging, and mitigating vulnerabilities, standard tools and practices, and how Chainguard Images can support secure-by-default software development.

### Source excerpt

Enroll in Chainguard Academy's new course on Painless Vulnerability Management to master security practices and use Chainguard Images for safer software.

## Blog: Introducing Falco 0.37.1

DevFeed: [Blog: Introducing Falco 0.37.1](<https://devfeed.tech/articles/blog-introducing-falco-0-37-1-32483.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-0-37-1/>)

Published: 2024-02-13T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Linux](<https://devfeed.tech/topics/linux.md>)

Tags: [announce](<https://devfeed.tech/tags/announce.md>), [bug](<https://devfeed.tech/tags/bug.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [docker](<https://devfeed.tech/tags/docker.md>), [falco](<https://devfeed.tech/tags/falco.md>), [release](<https://devfeed.tech/tags/release.md>)

### AI overview

Falco 0.37.1 is a patch release that fixes several bugs, adds driver-loader options and an HTTP-headers environment variable, updates Falcoctl and Libs, and changes libelf to dynamic linking. The static musl build is temporarily disabled.

### Source excerpt

Today we announce the release of Falco 0.37.1 🦅! Fixes Falco's 0.37.1 release is a small patch aimed at addressing a few minor bugs. It includes the following: Added --http-insecure flag to driver loader images Added new env variable FALCOCTL_DRIVER_HTTP_HEADERS understood by driver loader images to pass a comma separated list of http headers for driver download, eg: FALCOCTL_DRIVER_HTTP_HEADERS='x-emc-namespace: default,Proxy-Authenticate: Basic' Falcoctl was bumped to v0.7.2, fixing an issue building Flatcar drivers and a bug withing the kernel release fixup method to build drivers download URLs Fixed a nasty bug that caused Falco to crash when a priority higher than debug was set in the config: https://github.com/falcosecurity/falco/pull/3060 Libs were updated to 0.14.3 Last, but not least, as recommended by the CNCF, we now link libelf dynamically instead of statically, so that the library remains separable from Falco at runtime. This has multiple outcomes: Falco static (musl) build is disabled for now; we are experimenting with some solutions and we will hopefully be able to bring it back up soon Users of docker images won't notice anything since they already shipped libelf library Users of deb and rpm packages won't notice anything since libelf was already a nested dependency Users of the tar.gz package will need to manually install libelf where not present Thanks to everyone in the community for helping us in spotting these annoying bugs 🐛! You make Falco successful 🦅! Thanks as always to the Falco maintainers for their support and effort during the entire release process. Try it! 🏎 As usual, in case you just want to try out the stable Falco 0.37.1, you can install its packages following the process outlined in the docs: CentOS/Amazon Linux Debian/Ubuntu openSUSE Linux binary package Prefer to use a container image? No problem at all! 🐳 You can read more about running Falco with Docker in the docs. You can also find the Falcosecurity container images on the

## Chainguard's response to CVE-2023-6246 in glibc

DevFeed: [Chainguard's response to CVE-2023-6246 in glibc](<https://devfeed.tech/articles/chainguard-s-response-to-cve-2023-6246-in-glibc-12994.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguards-response-to-cve-2023-6246-in-glibc>)

Published: 2024-02-01T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [container-security](<https://devfeed.tech/topics/container-security.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container-image](<https://devfeed.tech/tags/container-image.md>), [container-image-security](<https://devfeed.tech/tags/container-image-security.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2023-6246](<https://devfeed.tech/tags/cve-2023-6246.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [glibc](<https://devfeed.tech/tags/glibc.md>), [security](<https://devfeed.tech/tags/security.md>), [wolfi](<https://devfeed.tech/tags/wolfi.md>)

### AI overview

Chainguard describes its response to CVE-2023-6246, a glibc heap-based buffer overflow that can enable local privilege escalation. The team patched the glibc Wolfi package and rebuilt affected Chainguard Images after coordinated disclosure.

### Source excerpt

Chainguard swiftly addresses CVE-2023-6246 in glibc, reinforcing container image security with rapid patch deployment and updated advisories.

[Next page](<https://devfeed.tech/tags/container-image.md?cursor=WyIyMDI0LTAyLTAxVDAwOjAwOjAwKzAwOjAwIiwgIjMxNzAyOTFjLWNiNjYtNGVlYy1hZWYwLWQ4MjVhZDYzOWIwNCJd>)