# container images Published articles for container images. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Catching poor LLM performance and accuracy before deployment DevFeed: [Catching poor LLM performance and accuracy before deployment]() Original publisher: [Read original article]() Author: Christopher Miyai Published: 2026-09-17T13:16:47Z Content type: article Language: en Sources: [Red Hat Developer]() Topics: [vllm](), [Inference Performance](), [LLM evaluation / benchmarking](), [benchmarking](), [CI/CD](), [model-deployment](), [Open Source](), [container]() Tags: [ai-inference](), [benchmarking](), [benchmarks](), [ci-cd](), [container-images](), [deployment](), [developer-tools](), [llm](), [open-source](), [performance](), [vllm]() ### AI overview This article describes a regression-testing system for Red Hat AI Inference that compares upstream and midstream vLLM builds. It benchmarks LLM performance and accuracy across hardware variants and uses CI/CD to detect regressions before release. ### Source excerpt vLLM is the leading open source inference and serving engine for LLMs. Averaging 64 commits a day with bi-weekly releases, the open source project goes through a significant amount of code changes rapidly. Red Hat AI Inference offers an integrated inference platform powered by vLLM, llm-d and vLLM's llm-compressor. The post Catching poor LLM performance and accuracy before deployment appeared first on Red Hat Developer. ## Publishing a Kubernetes SIG's Images to registry.k8s.io DevFeed: [Publishing a Kubernetes SIG's Images to registry.k8s.io]() Original publisher: [Read original article]() Author: The Kubernetes Authors Published: 2026-09-16T18:00:00Z Content type: tutorial Language: en Sources: [Kubernetes Contributors Blog]() Topics: [Kubernetes](), [container images](), [GitHub Actions](), [CI/CD](), [Google Cloud Platform (GCP)]() Tags: [ci-cd](), [container-image](), [container-image-registry](), [container-images](), [documentation](), [github-actions](), [google-cloud](), [guide](), [kubernetes]() ### AI overview A guide to publishing official Kubernetes SIG container images through registry.k8s.io. It explains why GHCR is unsuitable for public distribution and describes the ordered workflow involving Prow, Google Cloud Build, staging registries, and image promotion. ### Source excerpt If you're publishing container images for a Kubernetes SIG project, you might expect the same publishing workflow used by other container registries to work. That was my assumption too. My workflow successfully published the images, but they weren't publicly available. Instead, official Kubernetes project images are distributed through registry.k8s.io , the Kubernetes project's official container image registry. No single step was hard, but the steps were spread across multiple repositories and had to happen in a particular order, something I mostly learned by tripping over them. This post is the guide I wish I had at the start. It walks through that workflow end to end using Cluster Inventory API from SIG Multicluster as an example. The same process applies to eligible Kubernetes subprojects that publish official container images. My first attempt: GHCR I first tried a common GitHub release pattern: using GitHub Actions to publish images to ghcr.io on a tag push (cluster-inventory-api#40 ). The workflow succeeded, but Kubernetes GitHub organizations keep GHCR packages private, so GHCR cannot be used for public distribution. As described in the registry.k8s.io documentation , official images take a different route: Prow (the Kubernetes project's CI/CD system) picks up a tag push and runs Google Cloud Build on Kubernetes-owned infrastructure to push the image to a staging registry, and the image promoter then copies it to registry.k8s.io. The first-time setup, step by step Besides the image-owning repository, this touches three infrastructure repositories: kubernetes/k8s.io , kubernetes/test-infra , and kubernetes/org . The pieces depend on each other like this: Before you start: decide your project details Before setting up the publishing workflow, decide a few project-specific details. These values will be reused throughout the setup when creating the staging registry, configuring image builds, and setting up image promotion: , which determines the staging ## Athena spotlight: Black Duck on the importance of flagging zero-days at scale DevFeed: [Athena spotlight: Black Duck on the importance of flagging zero-days at scale]() Original publisher: [Read original article]() Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [Artificial Intelligence](), [Frontier AI](), [Frontier Model](), [Security](), [Open Source]() Tags: [ai](), [anthropic](), [athena](), [attacks](), [chainguard](), [code](), [container-images](), [frontier-ai](), [frontier-ai-models](), [frontier-model](), [management](), [mythos](), [open-source](), [osv](), [project-glasswing](), [scale](), [security](), [source](), [vulnerabilities]() ### AI overview The article explains how Black Duck and the Athena coalition address the growing volume of AI-discovered open source zero-day vulnerabilities. Athena members use frontier models to scan sandboxed applications, while Chainguard triages, validates, and remediates findings and shares artifacts and OSV data. Black Duck uses that feed to alert customers and provide mitigation and remediation guidance. ### Source excerpt AI can find zero-days faster than teams can fix them. See how Black Duck and Athena work together to turn findings into actionable protection. ## What it took to reach 1 billion build manifests DevFeed: [What it took to reach 1 billion build manifests]() Original publisher: [Read original article]() Published: 2026-09-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [container images](), [chainguard os](), [supply-chain-security](), [sigstore](), [Linux](), [NumPy]() Tags: [chainguard](), [chainguard-factory](), [chainguard-os](), [container-images](), [go](), [open-source](), [provenance](), [sbom](), [sigstore](), [software-supply-chain]() ### AI overview Chainguard describes how it doubled container build output from 500 million to more than 1 billion manifests in six months. The article explains how Chainguard Factory and Chainguard OS support continuous rebuilds, while using source builds, SLSA Level 3 provenance, Sigstore signatures, and full SBOMs. ### Source excerpt Chainguard doubled its container build output in six months. Learn how Factory 2.0 uses AI and reconciliation to rebuild secure software at scale. ## Announcing Chainguard container images for Go 1.27 DevFeed: [Announcing Chainguard container images for Go 1.27]() Original publisher: [Read original article]() Published: 2026-08-31T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [container images](), [Go Language](), [Cryptography](), [Deployment](), [Security, Privacy and Abuse Prevention](), [Post-Quantum]() Tags: [chainguard](), [container](), [container-images](), [cryptography](), [deployment](), [fedramp](), [fedramp-ato](), [fips](), [go](), [hardening](), [images](), [post-quantum](), [release]() ### AI overview Chainguard announces three Go 1.27 container images: go, go-fips, and go-openssl-fips. The options differ in their FIPS-validated cryptography, including whether cryptography is built in or selected at deployment time. ### Source excerpt Chainguard simplifies Go 1.27 with three images and a new option to choose FIPS-validated cryptography at deployment without recompiling. ## What Is a Container Registry and How to Use One DevFeed: [What Is a Container Registry and How to Use One]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-08-10T17:48:35Z Content type: tutorial Language: en Sources: [Kubernetes - KodeKloud Blog | DevOps, Cloud, Kubernetes, AI Tutorials & More]() Topics: [container images](), [content addressed store](), [Docker Hub](), [Dockerfile](), [supply-chain-security]() Tags: [base-images](), [cache](), [ci-cd](), [cloud](), [container-images](), [container-registry](), [containers](), [content-addressed-store](), [cryptographic](), [devops](), [docker](), [docker-hub](), [docker-login](), [docker-pull-rate-limits](), [docker-registry](), [harbor](), [image-manifest](), [image-retention-policy](), [image-scanning](), [image-tags-vs-digests](), [kubernetes](), [private-registry](), [pull-through-cache](), [reproducible-builds](), [security](), [supply-chain-security]() ### AI overview This guide explains how container registries store and distribute container images, emphasizing the distinction between mutable tags and immutable content digests. It also covers pushing, pulling, authentication, Docker Hub rate limits, caching, scanning, and retention. ### Source excerpt A tag is a bookmark somebody else can move. A digest is the image itself. Once that distinction lands, reproducible builds, supply chain security, and every it worked yesterday mystery make sense. ## Pulling multi-gigabyte container images in seconds on Amazon EKS DevFeed: [Pulling multi-gigabyte container images in seconds on Amazon EKS]() Original publisher: [Read original article]() Author: Sri Saran Balaji Vellore Rajakumar Published: 2026-08-10T16:00:00Z Content type: article Language: en Sources: [Kubernetes Overview, News and Trends | The New Stack]() Topics: [Amazon Elastic Kubernetes Service](), [container images](), [Machine learning](), [autoscaling](), [CUDA]() Tags: [ai-infrastructure](), [amazon-eks](), [autoscaling](), [aws-marketplace](), [container](), [container-images](), [containers](), [cuda](), [kubernetes](), [machine-learning](), [post-contributed](), [sponsor-aws-marketplace](), [sponsored-post-contributed]() ### AI overview This article explains how a production ML platform on Amazon EKS reduced multi-minute pulls of roughly 30 GB container images to seconds. Profiling found that software use of available hardware, rather than network bandwidth or the registry, was the main constraint; the resulting changes are available by default in EKS Auto Mode and were contributed upstream to containerd and the SOCI snapshotter. ### Source excerpt When the image is the bottleneck: Machine learning changed what a container image looks like. A typical application ships in The post Pulling multi-gigabyte container images in seconds on Amazon EKS appeared first on The New Stack. ## Pushing container images to China: what we learned the hard way DevFeed: [Pushing container images to China: what we learned the hard way]() Original publisher: [Read original article]() Author: Team Honey Badger Published: 2026-08-06T15:34:42Z Content type: article Language: en Sources: [Giant Swarm Blog]() Topics: [container images](), [ACR](), [Azure](), [Kubernetes](), [AI Infrastructure](), [Inference](), [Cloud]() Tags: [acr](), [ai-infrastructure](), [azure](), [china](), [circleci](), [container](), [container-image-building](), [container-images](), [firewall](), [inference](), [kubernetes]() ### AI overview This article explains why container image pushes to China can be much slower than elsewhere. It attributes the problem to China's separate registry infrastructure and cross-border transfer throttling, and says Giant Swarm cut delivery time to under two minutes with a split push through Singapore. ### Source excerpt Why container pushes to China take 30 minutes, and how Giant Swarm cut it to under 2 with a split push through Singapore. ## How to Automate Artifact Cleanup in Harness Artifact Registry Without Breaking Production DevFeed: [How to Automate Artifact Cleanup in Harness Artifact Registry Without Breaking Production]() Original publisher: [Read original article]() Author: Shibam Dhar Published: 2026-08-04T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [container images](), [Docker](), [Maven](), [npm](), [Helm charts](), [Python](), [CI/CD](), [sdlc](), [Microservice]() Tags: [ci-cd](), [cleanup](), [container-images](), [cost](), [deployment](), [docker](), [helm](), [npm](), [python](), [sdlc]() ### AI overview This hands-on walkthrough explains how Harness Artifact Registry lifecycle rules can automate cleanup across Docker, npm, Maven, Python, and Helm repositories while reducing the risk of deleting artifacts still used in production. It describes dry-run previews, governance tiers, recovery, and the limits of age-, count-, and tag-based rules. ### Source excerpt A hands-on walkthrough of Lifecycle Rules across Docker, npm, Maven, Python, and Helm. Includes dry-run preview, three-tier governance, and one-click recovery. | Blog ## Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL DevFeed: [Scaling Kubernetes governance: A platform engineer's guide to Kyverno and CEL]() Original publisher: [Read original article]() Author: Koray Oksay Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Kubernetes](), [Platform Engineering](), [Security](), [developer velocity](), [Containers](), [supply-chain-security](), [YAML](), [opa](), [rego]() Tags: [common-expression-language](), [compliance](), [container-images](), [containers](), [cosign](), [deployment](), [developer-velocity](), [governance](), [hipaa](), [integration](), [kubernetes](), [kyverno](), [pci-dss](), [platform](), [policy](), [security](), [security-policies](), [sigstore](), [soc-2](), [supply-chain-security]() ### AI overview A guide to using Kyverno and its Common Expression Language support for Kubernetes governance. It explains how platform engineering teams can enforce policies, automate resource changes, generate resources, verify image signatures, and maintain security and compliance while preserving developer velocity. ### Source excerpt Kyverno with CEL support provides Policy-as-Code for Kubernetes governance. Enforce security, automate guardrails, and boost developer velocity for platform engineering teams. ## Booz Allen Hamilton signs enterprise license agreement with Chainguard DevFeed: [Booz Allen Hamilton signs enterprise license agreement with Chainguard]() Original publisher: [Read original article]() Published: 2026-07-21T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [chainguard libraries](), [open-source-security](), [Security](), [Vulnerabilities](), [Open Source](), [Development]() Tags: [announce](), [ato](), [authority-to-operate](), [booz-allen-hamilton](), [booz-allen-hamilton-engineering](), [booz-chainguard-partnership](), [chainguard](), [chainguard-booz](), [chainguard-containers](), [chainguard-libraries](), [compliance](), [container-images](), [development](), [enterprise](), [government](), [partner](), [secure-by-default](), [security](), [supply-chain](), [trust](), [us](), [vulnerabilities]() ### AI overview Booz Allen Hamilton has signed an enterprise license agreement with Chainguard, giving more than 6,000 engineers access to Chainguard Containers and Chainguard Libraries across U.S. government programs. The agreement is intended to support secure-by-default software delivery, vulnerability remediation, compliance, and software supply chain requirements. ### Source excerpt Booz Allen and Chainguard partner to help 6,000+ engineers deliver secure-by-default software across U.S. government programs. ## Bring your Dockerfile to Vercel Functions DevFeed: [Bring your Dockerfile to Vercel Functions]() Original publisher: [Read original article]() Author: Joe Haddad Published: 2026-06-30T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Dockerfile](), [Containers](), [Docker]() Tags: [autoscaling](), [container-images](), [container-registry](), [containers](), [docker](), [docker-containers](), [oci](), [routing](), [vercel]() ### AI overview Vercel Functions now support deploying HTTP servers from Dockerfile or Containerfile projects using OCI-compatible container images on Fluid compute. Images are built, pushed to Vercel Container Registry, and deployed on each commit, while retaining Vercel preview deployments, logs, routing, and autoscaling benefits. ### Source excerpt Vercel Functions now support deploying HTTP servers from a Dockerfile or Containerfile, using Open Container Initiative (OCI) compatible images on Fluid compute. This makes it easier to bring existing applications written in any language to Vercel while keeping the preview deployments, logs, routing, and autoscaling benefits of using Vercel Functions and Fluid compute. To use container images with your functions, create a project with a Dockerfile.vercel (or Containerfile.vercel) file that starts an HTTP server listening on $PORT: This image will be built, pushed, and deployed on every commit to Vercel Container Registry. Learn more about using container images in the docs and see seven ways you can use Docker containers on Vercel. Read more ## Introducing VCR: Vercel Container Registry DevFeed: [Introducing VCR: Vercel Container Registry]() Original publisher: [Read original article]() Author: Wilson Wang Published: 2026-06-30T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Dockerfile](), [Containers](), [Authorization](), [OpenID connect (OIDC)](), [dashboards]() Tags: [authorization](), [container-images](), [container-registry](), [docker](), [infrastructure](), [oci](), [oidc](), [operations](), [registry](), [vercel](), [workflows]() ### AI overview Vercel introduces Vercel Container Registry, an OCI-compliant registry for pushing, pulling, and managing container images through standard Docker workflows. It supports project-scoped authorization, OIDC or access-token authentication, automatic optimization for Sandboxes and Functions, and integration with Vercel build and deployment workflows. ### Source excerpt You can now push, pull, and manage container images directly on Vercel. Vercel Container Registry is an OCI-compliant image registry hosted on Vercel infrastructure. It works with standard workflows like docker push, docker pull, and docker tag, so there's nothing new to learn or tooling to migrate. A Vercel project can have unlimited repositories. You can create and manage them through the Vercel dashboard, or push directly to VCR, which creates the repository for you on the fly. Operations use the same authorization controls as the rest of Vercel. You can authenticate with OIDC or an access token, provided the token has access to the project scope. Optimized for Fluid Compute When you push an image, VCR automatically optimizes it in the background for use in Sandboxes and Functions. VCR stores a precompiled snapshot and serves that snapshot when the image is requested. These snapshots use the same format as Sandbox Snapshots, which are optimized to run on Fluid Compute. Build and deploy on Vercel The Vercel build environment is automatically set up with authentication for the current project, so you can build and store images as part of the build and deploy process. You can also bring your Dockerfile to Vercel directly and host it with Vercel Functions or Vercel Sandboxes. Read more about VCR in the documentation. Read more ## Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard containers](), [container images](), [Security](), [Containers](), [chainguard libraries]() Tags: [chainguard](), [chainguard-containers](), [chainguard-gartner](), [chainguard-gartner-mq](), [chainguard-libraries](), [container-images](), [gartner](), [gartner-magic-quadrant](), [sboms](), [secure-by-default](), [security](), [software-supply-chain-security](), [software-supply-chain-security-gartner](), [software-supply-chain-security-mq](), [zero-cves]() ### AI overview Chainguard's article discusses its recognition as a Leader in Gartner's inaugural Magic Quadrant for Software Supply Chain Security. It argues that accelerating vulnerability exploitation and AI-assisted development require prevention-oriented, secure-by-default supply chain security. The article highlights Chainguard Containers, which provides minimal container images rebuilt daily from source, with zero CVEs, SBOMs, and verifiable signatures, and briefly introduces Chainguard Libraries. ### Source excerpt Gartner names Chainguard a Leader in Software Supply Chain Security, highlighting its secure-by-default approach and market vision. ## Faster than the advisory DevFeed: [Faster than the advisory]() Original publisher: [Read original article]() Published: 2026-06-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [argo-cd](), [GitOps](), [Vulnerabilities](), [Kubernetes](), [chainguard os](), [anthropic](), [Artificial Intelligence]() Tags: [ai](), [anthropic](), [argo-cd](), [chainguard-containers](), [chainguard-os](), [container-images](), [gitops](), [kubernetes](), [scanner-advisories](), [security](), [vulnerabilities](), [wolfi]() ### AI overview The article explains how Chainguard Factory delivered a patched Argo CD version to Wolfi and Chainguard OS before the related security advisory reached GitHub's global advisory database. It argues that automated upstream tracking and rapid remediation are increasingly important because vulnerability exploitation and AI-assisted discovery are outpacing traditional disclosure timelines. ### Source excerpt Chainguard often ships security fixes before advisories reach scanners. Learn why upstream speed matters in the era of AI-driven exploits. ## Eliminating Kubernetes Image Signature Replication DevFeed: [Eliminating Kubernetes Image Signature Replication]() Original publisher: [Read original article]() Author: The Kubernetes Authors Published: 2026-06-05T00:00:00Z Content type: article Language: en Sources: [Kubernetes Contributors Blog]() Topics: [Kubernetes](), [Replication](), [container images](), [Routing (disambiguation)](), [Latency](), [Google]() Tags: [cloud](), [container-images](), [cosign](), [kubernetes](), [latency](), [manifest](), [oidc](), [registry](), [replication](), [route](), [routing](), [sha256](), [signing](), [verify]() ### AI overview This article explains how Kubernetes eliminated replication of image signatures across 22 regional registries. Because signatures are small and regional latency is negligible, archeio now routes signature requests to a canonical registry while image layers continue using geo-routing. ### Source excerpt The image promoter rewrite laid the groundwork for simplifying how Kubernetes delivers container image signatures. One of the rewrite phases (Phase 6) separated image signing from signature replication into distinct pipeline stages. This follow-up covers the next step: eliminating signature replication entirely. The problem After promoting container images to registry.k8s.io, the promoter signs them using cosign with keyless (OIDC) signatures. These signatures are stored as OCI artifacts alongside the images, tagged with the convention sha256-.sig and sha256-.att. The registry.k8s.io domain is backed by archeio , a thin redirector that routes container image requests to the nearest regional Google Artifact Registry backend. When a user in Europe pulls an image, archeio redirects them to europe-west2-docker.pkg.dev; a user in Asia gets redirected to asia-east1-docker.pkg.dev, and so on across 22 regional backends. This geo-routing is great for image layers, where download locality matters for performance. But it created a problem for signatures: if the promoter only wrote a signature to one region, cosign verify would fail for users redirected to any other region. The solution was a dedicated replication pipeline that copied every .sig and .att tag to all 22 regional backends. This pipeline ran as a periodic Prow job every 2 hours on weekdays, performing thousands of API calls per run: listing tags across all repositories, diffing what existed where, and copying the missing signatures. The insight Signatures and attestations are small metadata artifacts, typically a few kilobytes each. Unlike image layers where geo-locality provides meaningful download performance improvements, fetching a signature from a non-local region adds negligible latency. The entire replication pipeline existed to optimize for a latency difference that users would never notice. The solution Instead of replicating signatures everywhere, archeio was taught to route signature req ## Chainguard brings first-party RHEL 9 and RHEL 10 RPM support to Chainguard OS, joins FINOS DevFeed: [Chainguard brings first-party RHEL 9 and RHEL 10 RPM support to Chainguard OS, joins FINOS]() Original publisher: [Read original article]() Published: 2026-05-11T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard os](), [chainguard containers](), [Security](), [Critical Infrastructure](), [Package Management](), [Open Source](), [Cloud Native Ecosystem](), [Resilience](), [APK](), [Linux]() Tags: [chainguard](), [chainguard-containers](), [chainguard-finserv](), [chainguard-os](), [cloud](), [cloud-native](), [compatibility](), [compliance](), [container](), [container-images](), [containers](), [critical-infrastructure](), [cve](), [dependencies](), [hardening](), [images](), [linux](), [make](), [mythos](), [open](), [open-source](), [project-glasswing](), [rhel](), [rhel-10](), [rhel-9]() ### AI overview Chainguard announces first-party RHEL 9 and RHEL 10 RPM compatibility for packages in Chainguard Containers built on Chainguard OS. The company also announces that it is joining FINOS to support open source collaboration in financial infrastructure. ### Source excerpt Chainguard adds first-party RHEL 9/10 RPM compatibility and joins FINOS, helping financial institutions modernize securely for the AI-driven threat era. ## Building the business case for a secure open source supply chain DevFeed: [Building the business case for a secure open source supply chain]() Original publisher: [Read original article]() Published: 2026-05-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [open-source-security](), [vulnerability management](), [cloud-infrastructure](), [CI/CD](), [distributed-systems](), [container images](), [engineering-culture]() Tags: [chainguard-assemble](), [chainguard-containers](), [chainguard-customers](), [cloud-infrastructure](), [cloud-native](), [compliance](), [container-images](), [continuous-delivery](), [cves](), [dependencies](), [distributed-systems](), [kyndryl](), [kyndryl-open-source](), [open-source](), [productivity](), [resilience](), [secure-open-source](), [software-supply-chain-security](), [supply-chain](), [vulnerabilities]() ### AI overview The article explains how organizations can build a business case for a secure open source supply chain. It describes a shift from framing open source security solely around CVEs, scanner results, and patching toward presenting trusted open source as a driver of productivity, resilience, and delivery speed. It also explains why traditional vulnerability management struggles with continuous delivery, distributed systems, frequently rebuilt container images, changing dependencies, and global cloud infrastructure. ### Source excerpt Learn how Kyndryl reframed open source security as a business driver -- reducing risk, lowering costs, and accelerating developer productivity. ## Managing third-party images at scale DevFeed: [Managing third-party images at scale]() Original publisher: [Read original article]() Published: 2026-04-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container images](), [Security](), [Vulnerabilities](), [cloud-infrastructure](), [code productivity](), [chainguard]() Tags: [appian](), [chainguard](), [chainguard-containers](), [chainguard-images](), [chainguard-os](), [cloud](), [compliance](), [container-image](), [container-images](), [containers](), [dependencies](), [developer-velocity](), [fedramp](), [hardened-images](), [scale](), [security](), [third-party-container-images](), [vulnerabilities]() ### AI overview This article explains how Appian approached managing third-party container images at scale with Chainguard. It describes the operational burden caused by image dependencies, vulnerabilities, maintenance, and compliance requirements, including the ongoing work needed for regulated environments such as FedRAMP. It also estimates that building a complete internal hardened-image program would require a dedicated team of 15 to 20 engineers. ### Source excerpt Learn how companies can scale third-party container image management with Chainguard to reduce risk, cut toil, and accelerate compliance and developer velocity. ## The State of Trusted Open Source: March 2026 DevFeed: [The State of Trusted Open Source: March 2026]() Original publisher: [Read original article]() Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [chainguard](), [Artificial Intelligence](), [container images](), [Vulnerabilities](), [Python](), [PostgreSQL]() Tags: [2026](), [ai](), [ai-cve-report](), [ai-vulnerability-report](), [chainguard](), [chainguard-containers](), [chainguard-cve-data](), [chainguard-cves](), [chainguard-data-report](), [container-images](), [cve](), [open-source](), [postgresql](), [python](), [report](), [state-of-open-source](), [state-of-trusted-open-source]() ### AI overview Chainguard's March 2026 State of Trusted Open Source report examines open-source consumption, container image usage, vulnerabilities, and remediation across its customer portfolio. It highlights AI-driven development, growth in Python and PostgreSQL usage, increasing standardization of the modern platform stack, and the use of Chainguard Base for customized developer tooling. ### Source excerpt AI is accelerating software and CVE growth. Chainguard's latest report shows rising risk in the long tail and how teams can stay secure at scale. ## Introducing Chainguard Repository: A unified experience for secure-by-default open source artifacts DevFeed: [Introducing Chainguard Repository: A unified experience for secure-by-default open source artifacts]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard repository](), [chainguard](), [Open Source](), [Security](), [Containers]() Tags: [agent-skills](), [ai-agents](), [chainguard](), [chainguard-repo](), [chainguard-repository](), [ci-cd-workflows](), [container-images](), [containers](), [libraries](), [open-source](), [open-source-artifacts](), [packages](), [policy](), [secure-by-default](), [virtual-machine-images]() ### AI overview Chainguard introduces Chainguard Repository, a unified experience for consuming secure-by-default open source artifacts with configurable policy enforcement. It brings together container images, libraries, OS packages, agent skills, CI/CD workflows, and virtual machine images through Chainguard-managed endpoints and provides compliance controls, security improvements through source rebuilds, and visibility dashboards. ### Source excerpt Chainguard Repository is a single, Chainguard-managed experience for pulling secure-by-default artifacts with built-in, configurable policy enforcement. ## Chainguard introduces Catalog Starter with five free trusted container images DevFeed: [Chainguard introduces Catalog Starter with five free trusted container images]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard catalog starter](), [chainguard catalog](), [container images](), [chainguard containers]() Tags: [chainguard-catalog](), [chainguard-catalog-starter](), [chainguard-containers](), [chainguard-free-tier](), [container-images](), [free](), [free-chainguard-containers](), [free-chainguard-images](), [security]() ### AI overview Chainguard introduces Catalog Starter, a free offering that lets developers choose five trusted container images from the Chainguard catalog for development and production workloads. ### Source excerpt Chainguard Catalog Starter is a new free offering that gives developers instant access to trusted container images from the industry's most comprehensive catalog ## Introducing Chainguard OS Packages: Secure ingredients for custom container builds DevFeed: [Introducing Chainguard OS Packages: Secure ingredients for custom container builds]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard os](), [container images](), [Docker Hardened Images](), [Vulnerabilities](), [Linux](), [Automation](), [Dockerfile](), [Open Source](), [bazel](), [chainguard sboms](), [APK]() Tags: [apk](), [apko](), [automation](), [base-images](), [bazel](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [chainguard-os](), [chainguard-os-packages](), [chainguard-packages](), [chainguard-sboms](), [container](), [container-images](), [cve](), [dockerfiles](), [open-source](), [sboms](), [secure-software-packages](), [software-packages](), [vulnerabilities](), [zero-cve-packages]() ### AI overview Chainguard introduces Chainguard OS Packages, a service providing continuously maintained, enterprise-grade packages and base images for teams that build custom container images. Customers retain control over image composition and build tooling while Chainguard handles package sourcing, rebuilding, vulnerability remediation, and SBOM generation. ### Source excerpt Chainguard OS Packages are enterprise-grade, zero-CVE packages and base images built and continuously maintained in the Chainguard Factory. ## Guardener automates migration from legacy Dockerfiles to secure Chainguard container images DevFeed: [Guardener automates migration from legacy Dockerfiles to secure Chainguard container images]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [AI Development](), [Dockerfile](), [migration](), [Security](), [Automation](), [supply-chain-security]() Tags: [agent](), [ai](), [ai-agents](), [ai-migration-agents](), [audit](), [automation](), [chainguard-ai-tools](), [chainguard-guardener](), [chainguard-the-guardener](), [container-images](), [distroless](), [dockerfiles](), [migration](), [security](), [vulnerabilities]() ### AI overview Chainguard introduces Guardener, an AI-native agent that helps engineering teams migrate legacy Dockerfiles to minimal Chainguard container images. It gathers environmental context, rebuilds Dockerfiles layer by layer, tests the results, and provides post-migration insights on image size, CVEs, and filesystem changes. ### Source excerpt Guardener is an AI-native agent that accelerates engineering teams' adoption of trusted open source artifacts across software development and deployment. [Next page]()