# distroless Published articles for distroless. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Mitigating WordPress attacks with containers DevFeed: [Mitigating WordPress attacks with containers]() Original publisher: [Read original article]() Published: 2026-07-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [WordPress](), [Containers](), [Exploit](), [Vulnerabilities]() Tags: [chainguard-containers](), [containers](), [database](), [distroless](), [files](), [hardened-containers](), [remote-code-execution](), [software-supply-chain-security](), [vulnerabilities](), [wordpress](), [wordpress-cves]() ### AI overview This article examines the wp2shell attack, in which two WordPress vulnerabilities can be chained to achieve remote code execution. It explains that hardened, distroless containers and read-only filesystems can limit an attacker's capabilities and simplify recovery, while emphasizing the need to update WordPress immediately. ### Source excerpt The wp2shell WordPress exploit enables remote code execution. Learn how hardened containers help reduce the blast radius of compromise. ## Guardener automates migration from legacy Dockerfiles to secure Chainguard container images DevFeed: [Guardener automates migration from legacy Dockerfiles to secure Chainguard container images]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [AI Development](), [Dockerfile](), [migration](), [Security](), [Automation](), [supply-chain-security]() Tags: [agent](), [ai](), [ai-agents](), [ai-migration-agents](), [audit](), [automation](), [chainguard-ai-tools](), [chainguard-guardener](), [chainguard-the-guardener](), [container-images](), [distroless](), [dockerfiles](), [migration](), [security](), [vulnerabilities]() ### AI overview Chainguard introduces Guardener, an AI-native agent that helps engineering teams migrate legacy Dockerfiles to minimal Chainguard container images. It gathers environmental context, rebuilds Dockerfiles layer by layer, tests the results, and provides post-migration insights on image size, CVEs, and filesystem changes. ### Source excerpt Guardener is an AI-native agent that accelerates engineering teams' adoption of trusted open source artifacts across software development and deployment. ## Chainguard OS and the Next Generation of Distroless Software Delivery DevFeed: [Chainguard OS and the Next Generation of Distroless Software Delivery]() Original publisher: [Read original article]() Published: 2025-03-20T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard os](), [distroless](), [Open Source](), [container images](), [open-source-security]() Tags: [beyond-distro](), [chainguard-os](), [chainguard-your-os](), [container-images](), [distroless](), [open-source-software](), [security](), [wolfi]() ### AI overview This article proposes a next generation of open source software delivery centered on distroless, purpose-built container images and upstream-maintained software packages. It introduces Chainguard OS, which Chainguard describes as continuously rebuilding packages from upstream sources to incorporate security fixes and performance improvements. ### Source excerpt Chainguard OS is the next generation in open source software delivery. Learn all about the principles and technology that make it possible. ## Have We Reached a Distroless Tipping Point? DevFeed: [Have We Reached a Distroless Tipping Point?]() Original publisher: [Read original article]() Published: 2025-03-18T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [distroless](), [Containers](), [Cloud Native Ecosystem](), [Open Source](), [Linux]() Tags: [beyond-distro](), [cgroups](), [chainguard-os](), [chainguard-your-os](), [cloud-native](), [containers](), [distroless](), [kernel](), [linux](), [oci](), [open-source](), [secure-by-design](), [wolfi]() ### AI overview The article argues that containerization and cloud-native software development have created an inflection point in open source software delivery. It presents the evolution from Linux Containers to Docker and the Open Container Initiative as milestones supporting a shift from traditional Linux distributions toward distroless, secure-by-design, continuously updated software. ### Source excerpt The world is at an inflection point in open source software delivery. See where the software distribution status quo is at, and what is next. ## 10 Docker Security Best Practices DevFeed: [10 Docker Security Best Practices]() Original publisher: [Read original article]() Author: Liran Tal; Omer Levi Hevroni Published: 2025-01-08T18:58:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Docker](), [container-security](), [Dockerfile](), [supply-chain-security](), [Kubernetes]() Tags: [acquisition](), [alpine](), [awareness](), [base-images](), [c](), [cheat-sheet](), [container-security](), [debian](), [developer](), [devops](), [devrel](), [devsecops](), [distroless](), [docker](), [go](), [google](), [security](), [security-best-practices](), [snyk-container](), [supply-chain-security](), [vulnerabilities]() ### AI overview This article explains Docker security across image builds, container runtime, supply-chain risks, and orchestration. It presents best practices including using minimal or distroless base images, multi-stage builds, reducing attack surface, and running containers with the least privilege. It also references Docker Hub, Kubernetes, Helm, Alpine Linux, Go, C, Debian, Node, and Google distroless images. ### Source excerpt Understand the basics of Docker security best practices with our Docker Cheat Sheet to improve container security. ## Check out Chainguard at KubeCon NA in Salt Lake City on November 12-15! DevFeed: [Check out Chainguard at KubeCon NA in Salt Lake City on November 12-15!]() Original publisher: [Read original article]() Published: 2024-10-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard images](), [container images](), [supply-chain-security](), [sigstore](), [distroless](), [CI/CD](), [Cloud](), [Security](), [devrel]() Tags: [chainguard](), [chainguard-images](), [ci-cd](), [cloud](), [cloud-native-rejekts](), [conference](), [container](), [debug](), [developers](), [devrel](), [devsecops](), [distroless](), [event](), [kubecon](), [kubernetes](), [multi-arch](), [sboms](), [security](), [sigstore](), [sigstorecon](), [slsa](), [software-supply-chain-security]() ### AI overview Chainguard announces its participation in KubeCon North America 2024 in Salt Lake City, including product demonstrations of Chainguard Images and appearances at Cloud-Native Rejekts and SigstoreCon. ### Source excerpt Chainguard is going to be at KubeCon North America 2024 in Salt Lake City. See where we'll be and how you can meet us to learn more about Chainguard Images. ## Avoid exploit chaining threats with Chainguard Images DevFeed: [Avoid exploit chaining threats with Chainguard Images]() Original publisher: [Read original article]() Published: 2024-04-23T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Exploit](), [Vulnerabilities](), [chainguard images](), [Security](), [Chrome](), [web applications](), [coding](), [GitHub]() Tags: [browsers](), [chainguard-images](), [chrome](), [coding](), [cve](), [distroless](), [exploit](), [exploit-chaining](), [github](), [image-cve](), [minimalism](), [security](), [security-best-practices](), [software](), [software-supply-chain](), [software-supply-chain-security](), [vulnerabilities]() ### AI overview The article explains how attackers combine multiple low-severity vulnerabilities into exploit chains that can produce severe compromise. It uses examples involving Pwn2Own devices and a Chrome renderer RCE analysis to emphasize risks from complex software interactions, memory management, and sandbox escapes, and it presents Chainguard Images and secure coding as defensive considerations. ### Source excerpt Understand exploit chaining -- linking vulnerabilities for devastating attacks. Learn defense strategies with Chainguard Images and secure coding practices. ## A more secure (and smaller) Big Bang DevFeed: [A more secure (and smaller) Big Bang]() Original publisher: [Read original article]() Published: 2024-04-09T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Security](), [Open Source](), [Software]() Tags: [big-bang](), [certificate-to-field](), [chainguard](), [chainguard-images](), [ctf](), [cves](), [distroless](), [hardened-container-image](), [iron-bank](), [open-source](), [platform-one](), [releases](), [united-states-air-force](), [wolfi]() ### AI overview Chainguard is working with Iron Bank to mirror Chainguard Images for the core Big Bang images, offering a drop-in alternative for Big Bang's secure software factory. The article reports a 100% reduction in CVEs, a 40% reduction in software components, and a 72% reduction in image size, with more than 30 images covering all eight core components. ### Source excerpt Chainguard enhances Big Bang with secure, smaller images: 100% fewer CVEs, 40% less components, 72% size reduction for fortified security. ## Building minimal and low CVE images for compiled languages DevFeed: [Building minimal and low CVE images for compiled languages]() Original publisher: [Read original article]() Published: 2024-02-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Containers](), [Docker](), [Dockerfile](), [Go Language](), [Vulnerabilities](), [Docker Hub](), [Debian](), [Ubuntu]() Tags: [chainguard](), [chainguard-images](), [compiled-language](), [containers](), [deployment](), [distroless](), [docker](), [docker-hub](), [dockerfiles](), [dockerhub](), [go](), [vulnerabilities]() ### AI overview This article demonstrates how to build smaller, lower-CVE container images for compiled languages by separating build and runtime concerns and replacing full Debian or Ubuntu bases with Chainguard Images. A Go web server example reduces the image from 892 MB to 775 MB and eliminates the reported CVEs after a one-line base-image change. ### Source excerpt Leverage Chainguard's insights to forge low-CVE, compact images for compiled languages, boosting your security posture. ## Images as Code: The pursuit of declarative image builds DevFeed: [Images as Code: The pursuit of declarative image builds]() Original publisher: [Read original article]() Published: 2024-01-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Code](), [chainguard images](), [Dockerfile](), [bazel](), [distroless](), [Docker](), [Containers](), [Kubernetes](), [Terraform](), [Infrastructure as code](), [Open Source]() Tags: [apk](), [apko](), [bazel](), [chainguard](), [chainguard-images](), [code](), [container-image](), [containers](), [declarative](), [distroless](), [docker](), [infrastructure-as-code](), [kubernetes](), [open-source](), [reproducibility](), [terraform]() ### AI overview The article traces the pursuit of declarative container image builds. It critiques imperative Dockerfile-based builds for making multi-tenant, multi-architecture, and reproducible builds difficult, then discusses Bazel and distroless images as steps toward expressing intended build state. Kubernetes and Terraform are presented as examples of declarative systems, inspiring the idea of "Images as Code." ### Source excerpt Chainguard's CTO Matt Moore describes the process of creating a declarative container image build for Chainguard Images. ## Announcing Bazel rules for extending Chainguard Images DevFeed: [Announcing Bazel rules for extending Chainguard Images]() Original publisher: [Read original article]() Published: 2023-10-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [supply-chain-security](), [container images](), [distroless](), [Package manager](), [Open Source]() Tags: [apk](), [apko](), [bazel](), [chainguard](), [chainguard-images](), [distroless](), [sbom](), [secure-software](), [secure-software-supply-chain](), [wolfi]() ### AI overview Chainguard and Aspect.Dev announce the general availability of rules_apko, an open source Bazel plugin for building secure, minimal Wolfi-based OCI container images. The article explains how rules_apko integrates APK packages and Wolfi-base images into existing Bazel workflows, supports reproducible builds, and provides dependency locking, integrity verification, and SBOM generation. ### Source excerpt Explore Bazel rules for Chainguard Images, your pathway to secure, effortless image extension. ## Understanding attacker techniques in distroless containers DevFeed: [Understanding attacker techniques in distroless containers]() Original publisher: [Read original article]() Published: 2023-10-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [distroless](), [Containers](), [Security](), [container-security](), [Vulnerabilities]() Tags: [chainguard](), [chainguard-images](), [container-security](), [containers](), [distroless](), [distroless-containers](), [exploit](), [rce](), [remote-code-execution](), [security](), [vulnerabilities]() ### AI overview The article examines attacker techniques relevant to distroless containers, drawing on a DEFCON 31 talk and an example involving PHP remote code execution, reverse shells, and injected spam content. It emphasizes keeping software up to date and using defense in depth. ### Source excerpt Explore DEFCON 31 insights on Distroless container security. Delve into RCE vulnerabilities and Chainguard's robust defense strategies for up-to-date software. ## How to use Dockerfiles with wolfi-base images DevFeed: [How to use Dockerfiles with wolfi-base images]() Original publisher: [Read original article]() Published: 2023-09-14T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [Dockerfile](), [Docker](), [chainguard images](), [distroless](), [container images](), [Linux](), [Go]() Tags: [apko](), [base-images](), [chainguard-images](), [container-images](), [distroless](), [docker](), [docker-hub](), [dockerfiles](), [go](), [guide](), [how-to](), [melange](), [wolfi]() ### AI overview This tutorial explains how to use Dockerfiles with Chainguard wolfi-base and other Chainguard Images. It covers minimal static images, glibc-dynamic images, multi-stage builds, package management, and selecting image variants based on application dependencies and runtime needs. ### Source excerpt Your guide to leveraging Dockerfiles with Wolfi-base images for hardened container images. ## Celebrating 5 years of NTIA's SBOM work DevFeed: [Celebrating 5 years of NTIA's SBOM work]() Original publisher: [Read original article]() Published: 2023-06-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [Security](), [chainguard](), [cisa](), [distroless]() Tags: [chainguard](), [cisa](), [cybersecurity](), [distroless](), [fedramp](), [openvex](), [sbom](), [software-bill-of-materials](), [software-dark-matter](), [software-supply-chain](), [software-supply-chain-security](), [sofware-supply-chain](), [ssdf](), [vex](), [vulnerability-scanning]() ### AI overview The article commemorates five years of the NTIA's Software Bill of Materials work and reviews the development of SBOMs as a foundation of software supply chain security. It describes the NTIA's initiative, its multi-stakeholder guidelines, and CISA's continuing role in advancing software transparency. ### Source excerpt Celebrate 5 transformative years of SBOM work with Chainguard, reflecting on the journey of software bill of materials. ## Chainguard Image now available for prometheus DevFeed: [Chainguard Image now available for prometheus]() Original publisher: [Read original article]() Published: 2023-04-14T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Prometheus](), [Security](), [vulnerability](), [vulnerability scanning](), [Containers](), [Go](), [Documentation]() Tags: [chainguard](), [chainguard-images](), [configuration](), [cosign](), [cves](), [distroless](), [documentation](), [go](), [image](), [kubernetes](), [prometheus](), [prometheus-image](), [sboms](), [security](), [slsa](), [toolchain](), [vulnerability-scanning](), [wolfi]() ### AI overview Chainguard announces a Prometheus container image built on Wolfi with a minimal, distroless-style base, hardened toolchain, continuous patching, and fewer reported CVEs. The image includes a default configuration, source-built binaries, SBOMs, signatures, and provenance support. ### Source excerpt Check out the new Chainguard Image for Prometheus that is minimal in size and contains fewer CVEs than other alternatives. ## It all started with a commit: Celebrating 6 years of Distroless DevFeed: [It all started with a commit: Celebrating 6 years of Distroless]() Original publisher: [Read original article]() Published: 2023-04-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [distroless](), [Containers](), [supply-chain-security](), [container images](), [sigstore](), [chainguard images](), [Kubernetes](), [vulnerability](), [bazel](), [Debian](), [vulnerability management](), [Go]() Tags: [bazel](), [c-plus-plus](), [chainguard](), [chainguard-images](), [containers](), [debian](), [digital-signatures](), [distroless](), [distroless-containers](), [go](), [java](), [kubernetes](), [python](), [release-engineering](), [sigstore](), [software-supply-chain-security](), [verify](), [vulnerability](), [vulnerability-management]() ### AI overview The article commemorates six years of Distroless, describing its goal of creating more secure and efficient container images by removing non-essential components. It covers the Bazel-based build tooling, language runtimes, Kubernetes adoption, vulnerability-management benefits, and later integration with Sigstore for container signing and authenticity verification. It also introduces the subsequent development of Chainguard Images. ### Source excerpt The goal of Distroless is to provide a more secure and efficient way to package and run software in containers by using only essential components. ## apko: a year later DevFeed: [apko: a year later]() Original publisher: [Read original article]() Published: 2023-02-28T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Development](), [Package manager](), [supply-chain-security](), [chainguard images](), [Unix](), [YAML](), [Terraform]() Tags: [alpine](), [apk](), [apko](), [chainguard](), [chainguard-enforce](), [chainguard-images](), [cloud-native](), [development](), [distroless](), [golang](), [linux](), [macos](), [melange](), [secure-software-supply-chain](), [terraform-provider](), [wolfi](), [yaml]() ### AI overview This article reviews apko one year after its public release. It describes apko's native Go implementation of the apk package manager, which runs on UNIX-like systems including macOS and BSDs, and explains how its declarative YAML interface helped support an ecosystem that includes Chainguard Images, Melange, Wolfi, and a Terraform provider. The article presents apko as a foundation for secure software supply chains through images-as-code and frequent image rebuilds. ### Source excerpt Dive in to apko and learn more about the project; where it's been in the past year, and where it's going.