# wolfi Published articles for wolfi. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Faster than the advisory DevFeed: [Faster than the advisory]() Original publisher: [Read original article]() Published: 2026-06-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [argo-cd](), [GitOps](), [Vulnerabilities](), [Kubernetes](), [chainguard os](), [anthropic](), [Artificial Intelligence]() Tags: [ai](), [anthropic](), [argo-cd](), [chainguard-containers](), [chainguard-os](), [container-images](), [gitops](), [kubernetes](), [scanner-advisories](), [security](), [vulnerabilities](), [wolfi]() ### AI overview The article explains how Chainguard Factory delivered a patched Argo CD version to Wolfi and Chainguard OS before the related security advisory reached GitHub's global advisory database. It argues that automated upstream tracking and rapid remediation are increasingly important because vulnerability exploitation and AI-assisted discovery are outpacing traditional disclosure timelines. ### Source excerpt Chainguard often ships security fixes before advisories reach scanners. Learn why upstream speed matters in the era of AI-driven exploits. ## Guiding the future of Chainguard OS: Announcing the FUD Committee DevFeed: [Guiding the future of Chainguard OS: Announcing the FUD Committee]() Original publisher: [Read original article]() Published: 2026-01-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard os](), [Security](), [supply-chain-security](), [Open Source](), [Linux]() Tags: [chainguard](), [chainguard-containers](), [chainguard-customers](), [chainguard-os](), [chainguard-steering-committee](), [enterprise](), [open-source](), [requirements](), [secure-by-default](), [security](), [software-supply-chain](), [wolfi]() ### AI overview Chainguard announces the Fully User Directed (FUD) Committee, a customer-led steering committee intended to guide the future of Chainguard OS. The committee will represent customer organizations and help shape technical decisions, standards, and the product roadmap around secure, production-scale software supply chain needs. ### Source excerpt The Chainguard OS Fully User Directed Committee is a customer-led steering committee for Chainguard OS. Learn how you can be a member. ## How Chainguard OS Uses Automated Package Garbage Collection to Reduce Security Risk DevFeed: [How Chainguard OS Uses Automated Package Garbage Collection to Reduce Security Risk]() Original publisher: [Read original article]() Published: 2025-12-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard os](), [open-source-security](), [Security](), [APK](), [container images](), [Process]() Tags: [apk](), [automated](), [chainguard-containers](), [chainguard-libraries](), [chainguard-operating-system](), [chainguard-os](), [chainguard-wolfi](), [container-images](), [cves](), [dependency](), [security](), [wolfi]() ### AI overview The article explains how Chainguard automates garbage collection for Chainguard OS and Wolfi APK repositories. It describes filtering older packages and checking dependencies and image usage before removal to keep repositories current and reduce potential attack surface while preserving image customization workflows. ### Source excerpt Learn how we keep Chainguard OS and Wolfi lean and secure with automated package garbage collection that cuts attack surface while preserving reproducibility. ## Avoiding Vendor Lock-in with a Compatible, Migration-Friendly, Transparent Container Distro DevFeed: [Avoiding Vendor Lock-in with a Compatible, Migration-Friendly, Transparent Container Distro]() Original publisher: [Read original article]() Published: 2025-09-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Containers](), [Linux](), [interoperability](), [migration](), [CI/CD](), [toolchain](), [Open Source]() Tags: [arm](), [chainguard-migration](), [chainguard-os](), [ci-cd](), [compatibility](), [container](), [distro](), [linux](), [migration](), [migration-guide](), [oci](), [open-source](), [sboms](), [supply-chain](), [toolchain](), [vendor-lock-in](), [wolfi](), [x86]() ### AI overview The article explains how to evaluate a Linux distribution for containerized workloads while reducing vendor lock-in. It emphasizes compatibility with existing toolchains and CI/CD workflows, transparent build processes, migration ease, interoperability, and adherence to standards such as OCI, CycloneDX, and SPDX. ### Source excerpt Learn how to evaluate and select the right Linux distribution to satisfy your team's needs, simplify migration, and avoid vendor lock-in. ## This Shit is Hard: Inside the Chainguard Factory DevFeed: [This Shit is Hard: Inside the Chainguard Factory]() Original publisher: [Read original article]() Published: 2025-05-27T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Automation](), [Linux](), [Kubernetes](), [Scalability](), [GitHub Actions](), [observability](), [Open Source]() Tags: [automation](), [chainguard](), [chainguard-containers](), [chainguard-factory](), [chainguard-libraries](), [chainguard-os](), [cve-remediation](), [github-actions](), [infrastructure](), [kubernetes](), [linux](), [observability](), [open-source](), [scalability](), [speed](), [wolfi]() ### AI overview Chainguard describes how its Factory uses infrastructure, automation, and a custom Kubernetes-based build system to build and test thousands of packages and images. The article says the system replaced GitHub Actions and improved observability, scalability, and usability while supporting CVE remediation targets. ### Source excerpt The Chainguard Factory combines world-class talent and automation to produce packages and images at a level of speed unmatched by any other Linux distribution. ## Chainguard OS and the Next Generation of Distroless Software Delivery DevFeed: [Chainguard OS and the Next Generation of Distroless Software Delivery]() Original publisher: [Read original article]() Published: 2025-03-20T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard os](), [distroless](), [Open Source](), [container images](), [open-source-security]() Tags: [beyond-distro](), [chainguard-os](), [chainguard-your-os](), [container-images](), [distroless](), [open-source-software](), [security](), [wolfi]() ### AI overview This article proposes a next generation of open source software delivery centered on distroless, purpose-built container images and upstream-maintained software packages. It introduces Chainguard OS, which Chainguard describes as continuously rebuilding packages from upstream sources to incorporate security fixes and performance improvements. ### Source excerpt Chainguard OS is the next generation in open source software delivery. Learn all about the principles and technology that make it possible. ## Have We Reached a Distroless Tipping Point? DevFeed: [Have We Reached a Distroless Tipping Point?]() Original publisher: [Read original article]() Published: 2025-03-18T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [distroless](), [Containers](), [Cloud Native Ecosystem](), [Open Source](), [Linux]() Tags: [beyond-distro](), [cgroups](), [chainguard-os](), [chainguard-your-os](), [cloud-native](), [containers](), [distroless](), [kernel](), [linux](), [oci](), [open-source](), [secure-by-design](), [wolfi]() ### AI overview The article argues that containerization and cloud-native software development have created an inflection point in open source software delivery. It presents the evolution from Linux Containers to Docker and the Open Container Initiative as milestones supporting a shift from traditional Linux distributions toward distroless, secure-by-design, continuously updated software. ### Source excerpt The world is at an inflection point in open source software delivery. See where the software distribution status quo is at, and what is next. ## Disrupting the Status (Distro)Quo DevFeed: [Disrupting the Status (Distro)Quo]() Original publisher: [Read original article]() Published: 2025-03-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [Linux](), [Operating system](), [releases](), [cloud-infrastructure](), [Embedded Software Dev]() Tags: [chainguard-os](), [debian](), [distro](), [embedded-systems](), [infrastructure](), [linux](), [open-source](), [open-source-software](), [release](), [releases](), [ubuntu](), [wolfi]() ### AI overview This first article in a three-part series traces how UNIX and Linux distributions became the dominant model for delivering open source software. It examines snapshot-based releases, differing release schedules, and the long-term maintenance concerns created by software bundled and frozen in traditional distributions. ### Source excerpt The traditional "distro" model of open source software delivery is ready for innovation. Learn how we got to this point and what comes next. ## Wolfi Moves to usrmerge Standard DevFeed: [Wolfi Moves to usrmerge Standard]() Original publisher: [Read original article]() Published: 2025-03-07T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Linux](), [migration](), [container images]() Tags: [chainguard](), [compatibility](), [filesystem](), [layout](), [linux](), [migration](), [standard](), [usrmerge](), [wolfi]() ### AI overview Chainguard is adopting the usrmerge filesystem layout for Wolfi to improve standardization and compatibility with modern Linux applications and other major distributions. The transition moves binaries and libraries from legacy directories into /usr locations using corresponding symlinks, with the final /lib migration scheduled for June 23, 2025. ### Source excerpt To enhance standardization and compatibility with modern Linux applications and other major distributions, Chainguard is adopting the usrmerge filesystem layout. ## Building .NET Runtime from Source - The Chainguard Way DevFeed: [Building .NET Runtime from Source - The Chainguard Way]() Original publisher: [Read original article]() Published: 2025-02-26T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [.NET](), [container images](), [Open Source](), [vulnerability]() Tags: [built-from-source](), [chainguard](), [chainguard-images](), [container-images](), [cve](), [cve-remediation](), [dependency](), [integrity](), [microsoft](), [net](), [open-source](), [wolfi]() ### AI overview Chainguard describes building all .NET 8 and .NET 9 components entirely from source. The approach addresses challenges involving multiple repositories, circular dependencies, prebuilt binary dependencies, and cross-repository changes, while enabling faster CVE remediation, end-to-end integrity, and greater build transparency for .NET container images. ### Source excerpt Chainguard builds all .NET8 and .NET9 components entirely from source to enable faster CVE remediation, full end-to-end integrity, and build transparency. ## Panic! At The Distro: A Study of Malware Prevention in Linux Distributions DevFeed: [Panic! At The Distro: A Study of Malware Prevention in Linux Distributions]() Original publisher: [Read original article]() Published: 2024-12-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Linux](), [Malware](), [Maintainers](), [open-source-security](), [Benchmark](), [dataset]() Tags: [alpine](), [benchmark](), [dataset](), [debian](), [distribution](), [false-positives](), [linux](), [maintainers](), [malware](), [malware-prevention](), [open-source-software](), [reproducible-builds](), [research](), [scanners](), [software-supply-chain](), [wolfi]() ### AI overview Chainguard studies malware prevention in Linux distributions through maintainer interviews and a Linux package malware benchmark dataset. The study reports that most interviewed distributions do not proactively scan repositories, while existing open-source malware scanners often produce false positives. ### Source excerpt Chainguard wanted to know more about malware prevention in Linux distributions. So we did a study to see what maintainers are doing about it. See the results. ## Wolfi's upstream security inspection: Scanning with OpenSSF Scorecard DevFeed: [Wolfi's upstream security inspection: Scanning with OpenSSF Scorecard]() Original publisher: [Read original article]() Published: 2024-08-02T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [open-source-security](), [Security](), [Open Source](), [openssf](), [GitHub](), [Maintainers]() Tags: [chainguard-labs](), [github](), [maintainers](), [open-source-security](), [openssf](), [research](), [security](), [wolfi]() ### AI overview Chainguard Labs evaluated the security of 1,511 upstream Wolfi repositories using the OpenSSF Scorecard. The mean score was 5.4 out of 10; repositories associated with Ruby and C packages had lower average scores of 4.8 and 4.7, respectively. ### Source excerpt Chainguard Labs analyzed the security of 1,500+ upstream Wolfi repositories using the OpenSSF Scorecard tool -- uncover the key findings in the latest research. ## Chainguard enhances security with OSV advisory feed DevFeed: [Chainguard enhances security with OSV advisory feed]() Original publisher: [Read original article]() Published: 2024-07-02T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [vulnerability management](), [open-source-security](), [vulnerability](), [Vulnerabilities](), [Maintainers](), [chainguard images](), [data](), [Open Source](), [Google]() Tags: [chainguard](), [chainguard-images](), [google](), [maintainers](), [open-source](), [open-source-vulnerabilities](), [openssf](), [osv](), [secure-open-source](), [secure-software](), [security](), [vulnerability](), [vulnerability-data](), [vulnerability-management](), [wolfi]() ### AI overview Chainguard is publishing its security advisory feed in the OSV format, improving the precision and usability of vulnerability information for open source maintainers and downstream consumers. ### Source excerpt Explore Chainguard's new OSV advisory feed, delivering comprehensive and up-to-date vulnerability information to enhance your security posture. ## Vulnerability fixes in plain sight: How your scanners are missing hundreds of vulnerabilities DevFeed: [Vulnerability fixes in plain sight: How your scanners are missing hundreds of vulnerabilities]() Original publisher: [Read original article]() Published: 2024-06-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [Security](), [chainguard](), [NVD](), [chainguard images](), [container images](), [Open Source]() Tags: [chainguard](), [chainguard-images](), [container-images](), [cve](), [cve-list](), [cves](), [nvd](), [open-source-software](), [remote-code-execution-vulnerability](), [research](), [sca](), [security](), [software-composition-analysis](), [vulnerabilities](), [vulnerability-fix](), [vulnerability-scanning](), [wolfi]() ### AI overview An analysis of more than 600 Wolfi-packaged projects found over 100 security fixes without associated CVEs. Because vulnerability scanners and SCA tools rely on vulnerability databases such as the NVD, organizations may miss fixes unless they keep software updated. ### Source excerpt Are your vulnerability scanners missing critical security flaws? Discover how Chainguard's research reveals hundreds of vulnerabilities hiding in plain sight. ## Migrating a Node.js application to Chainguard Images DevFeed: [Migrating a Node.js application to Chainguard Images]() Original publisher: [Read original article]() Published: 2024-06-05T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Node.js](), [supply-chain-security](), [Dockerfile](), [Docker]() Tags: [chainguard](), [chainguard-images](), [debian](), [docker](), [express](), [minimal-image](), [node-js](), [node-js-migration](), [software-supply-chain-security](), [vulnerabilities](), [wolfi]() ### AI overview A tutorial on migrating a containerized Node.js application from the official Node image to Chainguard Images. It covers dependency updates, moving from restify to express, adapting Dockerfile build steps for Wolfi, and using minimal images to reduce container size, tooling, and known vulnerabilities. ### Source excerpt Secure and streamline your Node.js applications with Chainguard Images. Learn how to migrate seamlessly and enhance your software supply chain security. ## Wolfi at work: Minimal developer workstations in the cloud DevFeed: [Wolfi at work: Minimal developer workstations in the cloud]() Original publisher: [Read original article]() Published: 2024-05-29T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [Cloud](), [chainguard](), [Linux](), [Terraform](), [Automation](), [Security](), [Visual Studio Code](), [ssh]() Tags: [automation](), [chainguard](), [ci-cd](), [cloud](), [developer](), [ephemerality](), [linux](), [minimalism](), [security](), [ssh](), [terraform](), [visual-studio-code](), [wolfi]() ### AI overview Chainguard describes using minimal Wolfi-based cloud workstations to provide standardized, ephemeral development environments for engineers. The workstations use regularly rebuilt and attested images, automatic timeouts, and Terraform-managed resources to keep packages current and reduce configuration differences. ### Source excerpt Secure development environments with cloud workstations powered by Chainguard's Wolfi. Learn how to reduce attack surface and improve developer productivity. ## Reducing vulnerabilities in Backstage with Chainguard's Wolfi DevFeed: [Reducing vulnerabilities in Backstage with Chainguard's Wolfi]() Original publisher: [Read original article]() Published: 2024-05-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Backstage](), [chainguard](), [chainguard images](), [Vulnerabilities](), [internal developer portal](), [Security](), [supply-chain-security](), [Developer experience](), [Dockerfile]() Tags: [backstage](), [chainguard](), [chainguard-images](), [container-images](), [developer-experience](), [developer-portal](), [docker](), [security](), [software-supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-management](), [wolfi]() ### AI overview This guest post describes how American Airlines evaluated Chainguard's Wolfi and wolfi-base image as an alternative base for its Backstage developer portal. The author reports that the original base image contained 74 vulnerabilities and that the default Docker build added 330 more, motivating a Dockerfile refactoring effort focused on reducing packages, image size, vulnerabilities, and software supply-chain risk while maintaining compatibility. ### Source excerpt Learn how American Airlines enhanced Backstage security with Chainguard's Wolfi. ## Changes to static, Git, and BusyBox Developer Images DevFeed: [Changes to static, Git, and BusyBox Developer Images]() Original publisher: [Read original article]() Published: 2024-05-15T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Security](), [Docker](), [Docker Hub]() Tags: [alpine](), [chainguard](), [chainguard-images](), [docker](), [docker-hub](), [security](), [wolfi](), [x86]() ### AI overview Chainguard is moving its static, Git, and BusyBox Developer Images from Alpine Linux bases to Wolfi bases on July 15, 2024, to improve their security posture. Users should test the Wolfi-based images beforehand, especially when using unsupported architectures or Alpine-specific behavior. Alpine-based alternatives are available on ghcr.io for some cases, but they will not receive monitoring or be synchronized to Docker Hub. ### Source excerpt Learn about the latest changes to Chainguard's static, git and busybox Developer Images. Enhance your software development with improved security and efficiency. ## A more secure (and smaller) Big Bang DevFeed: [A more secure (and smaller) Big Bang]() Original publisher: [Read original article]() Published: 2024-04-09T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Security](), [Open Source](), [Software]() Tags: [big-bang](), [certificate-to-field](), [chainguard](), [chainguard-images](), [ctf](), [cves](), [distroless](), [hardened-container-image](), [iron-bank](), [open-source](), [platform-one](), [releases](), [united-states-air-force](), [wolfi]() ### AI overview Chainguard is working with Iron Bank to mirror Chainguard Images for the core Big Bang images, offering a drop-in alternative for Big Bang's secure software factory. The article reports a 100% reduction in CVEs, a 40% reduction in software components, and a 72% reduction in image size, with more than 30 images covering all eight core components. ### Source excerpt Chainguard enhances Big Bang with secure, smaller images: 100% fewer CVEs, 40% less components, 72% size reduction for fortified security. ## Chainguard patches 3 "silent" Golang CVEs in under 24 hours DevFeed: [Chainguard patches 3 "silent" Golang CVEs in under 24 hours]() Original publisher: [Read original article]() Published: 2024-03-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Vulnerabilities](), [Go](), [chainguard images](), [Security](), [Automation](), [toolchain](), [DDoS](), [Monitoring](), [Open Source](), [Pull Request](), [Linux]() Tags: [automation](), [chainguard](), [chainguard-images](), [cve](), [cves](), [ddos](), [github](), [go](), [golang](), [golang-patch](), [linux](), [melange](), [merge](), [monitoring](), [safe-source-for-open-source](), [security](), [silent-cve](), [tooling](), [wolfi]() ### AI overview Chainguard describes how it patched three Golang CVEs in under 24 hours. Its automation monitored new Go releases, opened a pull request, rebuilt the Wolfi package, and updated Chainguard Images containing Go. ### Source excerpt See how Chainguard swiftly patched three Golang CVEs in under 24 hours, showcasing rapid response and dedication to secure software. ## Get 'em while they're hot! How and why Wolfi releases are so fast DevFeed: [Get 'em while they're hot! How and why Wolfi releases are so fast]() Original publisher: [Read original article]() Published: 2024-02-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [releases](), [chainguard images](), [container images](), [Vulnerabilities](), [Linux]() Tags: [chainguard](), [chainguard-images](), [container-images](), [cve](), [github](), [releases](), [security-solutions](), [upstream-release](), [vulnerabilities](), [wolfi]() ### AI overview The article explains how Wolfi achieves rapid package updates, with more than 80% completed within 24 hours and a median update time of four hours. It connects this speed to reducing known vulnerabilities in Chainguard Images. ### Source excerpt Explore Wolfi's speedy updates: A key to securing Chainguard Images against vulnerabilities and delivering up-to-date software swiftly. ## Reimagining the Linux distro with Wolfi DevFeed: [Reimagining the Linux distro with Wolfi]() Original publisher: [Read original article]() Published: 2024-02-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Linux](), [chainguard](), [container-security](), [Security](), [Package Management](), [APK](), [Open Source]() Tags: [apk](), [apko](), [chainguard](), [chainguard-images](), [container-security](), [cve](), [linux](), [melange](), [open-source](), [package-management](), [secure-container-images](), [security](), [vulnerabilities](), [wolfi]() ### AI overview The article explains why Chainguard created Wolfi, a minimal Linux distribution designed for modern container use. It describes the roles of Melange for building APK packages and Apko for assembling reproducible container images, along with Wolfi's security advisory and vulnerability-management capabilities. ### Source excerpt Discover Wolfi: Chainguard's answer to modern container security, creating minimal, secure Linux distributions for today's needs. ## Continuous hardening of Chainguard's internal software supply chain DevFeed: [Continuous hardening of Chainguard's internal software supply chain]() Original publisher: [Read original article]() Published: 2024-02-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [GitHub Actions](), [Security](), [Docker Compose](), [Terraform]() Tags: [chainguard](), [cosign](), [github](), [github-actions](), [github-vulnerability](), [hardending](), [hardened-images](), [hardening](), [integrity](), [least-privilege](), [minimalism](), [security](), [software-supply-chain](), [terraform-provider](), [wolfi]() ### AI overview Chainguard describes how it mitigated a potentially vulnerable GitHub Actions workflow that could have affected the integrity of Docker images signed by its cosign Terraform Provider. The team responded within 24 hours and explains how least privilege, minimal defaults, and dependency minimization support software supply chain security. ### Source excerpt See how Chainguard mitigated the potential vulnerable GitHub actions workflow "Pwn request" in less than 24 hours. ## Wolfi's approach to container security and CVE management DevFeed: [Wolfi's approach to container security and CVE management]() Original publisher: [Read original article]() Published: 2024-02-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container-security](), [Containers](), [open-source-security](), [Security](), [Open Source]() Tags: [apko](), [container-security](), [cve](), [cve-management](), [melange](), [oci](), [secure-images](), [secure-software-supply-chain](), [security](), [software-supply-chain](), [wolfi]() ### AI overview The article explains how Wolfi, a secure-by-default undistro, supports container security by helping create minimal, reproducible OCI-compliant images and reducing software supply chain risks. It also describes how Wolfi powers Chainguard Images. ### Source excerpt Discover Wolfi, the 'secure-by-default' undistro for container security, enhancing open-source software with minimal CVE counts and robust protection. [Next page]()