# container images Container images are standardized packages containing the files, binaries, libraries, and configurations needed to run a container; they are immutable and composed of layers. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Publishing a Kubernetes SIG's Images to registry.k8s.io DevFeed: [Publishing a Kubernetes SIG's Images to registry.k8s.io]() Original publisher: [Read original article]() Author: The Kubernetes Authors Published: 2026-09-16T18:00:00Z Content type: tutorial Language: en Sources: [Kubernetes Contributors Blog]() Topics: [Kubernetes](), [container images](), [GitHub Actions](), [CI/CD](), [Google Cloud Platform (GCP)]() Tags: [ci-cd](), [container-image](), [container-image-registry](), [container-images](), [documentation](), [github-actions](), [google-cloud](), [guide](), [kubernetes]() ### AI overview A guide to publishing official Kubernetes SIG container images through registry.k8s.io. It explains why GHCR is unsuitable for public distribution and describes the ordered workflow involving Prow, Google Cloud Build, staging registries, and image promotion. ### Source excerpt If you're publishing container images for a Kubernetes SIG project, you might expect the same publishing workflow used by other container registries to work. That was my assumption too. My workflow successfully published the images, but they weren't publicly available. Instead, official Kubernetes project images are distributed through registry.k8s.io , the Kubernetes project's official container image registry. No single step was hard, but the steps were spread across multiple repositories and had to happen in a particular order, something I mostly learned by tripping over them. This post is the guide I wish I had at the start. It walks through that workflow end to end using Cluster Inventory API from SIG Multicluster as an example. The same process applies to eligible Kubernetes subprojects that publish official container images. My first attempt: GHCR I first tried a common GitHub release pattern: using GitHub Actions to publish images to ghcr.io on a tag push (cluster-inventory-api#40 ). The workflow succeeded, but Kubernetes GitHub organizations keep GHCR packages private, so GHCR cannot be used for public distribution. As described in the registry.k8s.io documentation , official images take a different route: Prow (the Kubernetes project's CI/CD system) picks up a tag push and runs Google Cloud Build on Kubernetes-owned infrastructure to push the image to a staging registry, and the image promoter then copies it to registry.k8s.io. The first-time setup, step by step Besides the image-owning repository, this touches three infrastructure repositories: kubernetes/k8s.io , kubernetes/test-infra , and kubernetes/org . The pieces depend on each other like this: Before you start: decide your project details Before setting up the publishing workflow, decide a few project-specific details. These values will be reused throughout the setup when creating the staging registry, configuring image builds, and setting up image promotion: , which determines the staging ## What it took to reach 1 billion build manifests DevFeed: [What it took to reach 1 billion build manifests]() Original publisher: [Read original article]() Published: 2026-09-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [container images](), [chainguard os](), [supply-chain-security](), [sigstore](), [Linux](), [NumPy]() Tags: [chainguard](), [chainguard-factory](), [chainguard-os](), [container-images](), [go](), [open-source](), [provenance](), [sbom](), [sigstore](), [software-supply-chain]() ### AI overview Chainguard describes how it doubled container build output from 500 million to more than 1 billion manifests in six months. The article explains how Chainguard Factory and Chainguard OS support continuous rebuilds, while using source builds, SLSA Level 3 provenance, Sigstore signatures, and full SBOMs. ### Source excerpt Chainguard doubled its container build output in six months. Learn how Factory 2.0 uses AI and reconciliation to rebuild secure software at scale. ## Announcing Chainguard container images for Go 1.27 DevFeed: [Announcing Chainguard container images for Go 1.27]() Original publisher: [Read original article]() Published: 2026-08-31T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [container images](), [Go Language](), [Cryptography](), [Deployment](), [Security, Privacy and Abuse Prevention](), [Post-Quantum]() Tags: [chainguard](), [container](), [container-images](), [cryptography](), [deployment](), [fedramp](), [fedramp-ato](), [fips](), [go](), [hardening](), [images](), [post-quantum](), [release]() ### AI overview Chainguard announces three Go 1.27 container images: go, go-fips, and go-openssl-fips. The options differ in their FIPS-validated cryptography, including whether cryptography is built in or selected at deployment time. ### Source excerpt Chainguard simplifies Go 1.27 with three images and a new option to choose FIPS-validated cryptography at deployment without recompiling. ## What Is a Container Registry and How to Use One DevFeed: [What Is a Container Registry and How to Use One]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-08-10T17:48:35Z Content type: tutorial Language: en Sources: [Kubernetes - KodeKloud Blog | DevOps, Cloud, Kubernetes, AI Tutorials & More]() Topics: [container images](), [content addressed store](), [Docker Hub](), [Dockerfile](), [supply-chain-security]() Tags: [base-images](), [cache](), [ci-cd](), [cloud](), [container-images](), [container-registry](), [containers](), [content-addressed-store](), [cryptographic](), [devops](), [docker](), [docker-hub](), [docker-login](), [docker-pull-rate-limits](), [docker-registry](), [harbor](), [image-manifest](), [image-retention-policy](), [image-scanning](), [image-tags-vs-digests](), [kubernetes](), [private-registry](), [pull-through-cache](), [reproducible-builds](), [security](), [supply-chain-security]() ### AI overview This guide explains how container registries store and distribute container images, emphasizing the distinction between mutable tags and immutable content digests. It also covers pushing, pulling, authentication, Docker Hub rate limits, caching, scanning, and retention. ### Source excerpt A tag is a bookmark somebody else can move. A digest is the image itself. Once that distinction lands, reproducible builds, supply chain security, and every it worked yesterday mystery make sense. ## Pulling multi-gigabyte container images in seconds on Amazon EKS DevFeed: [Pulling multi-gigabyte container images in seconds on Amazon EKS]() Original publisher: [Read original article]() Author: Sri Saran Balaji Vellore Rajakumar Published: 2026-08-10T16:00:00Z Content type: article Language: en Sources: [Kubernetes Overview, News and Trends | The New Stack]() Topics: [Amazon Elastic Kubernetes Service](), [container images](), [Machine learning](), [autoscaling](), [CUDA]() Tags: [ai-infrastructure](), [amazon-eks](), [autoscaling](), [aws-marketplace](), [container](), [container-images](), [containers](), [cuda](), [kubernetes](), [machine-learning](), [post-contributed](), [sponsor-aws-marketplace](), [sponsored-post-contributed]() ### AI overview This article explains how a production ML platform on Amazon EKS reduced multi-minute pulls of roughly 30 GB container images to seconds. Profiling found that software use of available hardware, rather than network bandwidth or the registry, was the main constraint; the resulting changes are available by default in EKS Auto Mode and were contributed upstream to containerd and the SOCI snapshotter. ### Source excerpt When the image is the bottleneck: Machine learning changed what a container image looks like. A typical application ships in The post Pulling multi-gigabyte container images in seconds on Amazon EKS appeared first on The New Stack. ## Pushing container images to China: what we learned the hard way DevFeed: [Pushing container images to China: what we learned the hard way]() Original publisher: [Read original article]() Author: Team Honey Badger Published: 2026-08-06T15:34:42Z Content type: article Language: en Sources: [Giant Swarm Blog]() Topics: [container images](), [ACR](), [Azure](), [Kubernetes](), [AI Infrastructure](), [Inference](), [Cloud]() Tags: [acr](), [ai-infrastructure](), [azure](), [china](), [circleci](), [container](), [container-image-building](), [container-images](), [firewall](), [inference](), [kubernetes]() ### AI overview This article explains why container image pushes to China can be much slower than elsewhere. It attributes the problem to China's separate registry infrastructure and cross-border transfer throttling, and says Giant Swarm cut delivery time to under two minutes with a split push through Singapore. ### Source excerpt Why container pushes to China take 30 minutes, and how Giant Swarm cut it to under 2 with a split push through Singapore. ## How to Automate Artifact Cleanup in Harness Artifact Registry Without Breaking Production DevFeed: [How to Automate Artifact Cleanup in Harness Artifact Registry Without Breaking Production]() Original publisher: [Read original article]() Author: Shibam Dhar Published: 2026-08-04T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [container images](), [Docker](), [Maven](), [npm](), [Helm charts](), [Python](), [CI/CD](), [sdlc](), [Microservice]() Tags: [ci-cd](), [cleanup](), [container-images](), [cost](), [deployment](), [docker](), [helm](), [npm](), [python](), [sdlc]() ### AI overview This hands-on walkthrough explains how Harness Artifact Registry lifecycle rules can automate cleanup across Docker, npm, Maven, Python, and Helm repositories while reducing the risk of deleting artifacts still used in production. It describes dry-run previews, governance tiers, recovery, and the limits of age-, count-, and tag-based rules. ### Source excerpt A hands-on walkthrough of Lifecycle Rules across Docker, npm, Maven, Python, and Helm. Includes dry-run preview, three-tier governance, and one-click recovery. | Blog ## Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security DevFeed: [Building a category: Chainguard named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security]() Original publisher: [Read original article]() Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard containers](), [container images](), [Security](), [Containers](), [chainguard libraries]() Tags: [chainguard](), [chainguard-containers](), [chainguard-gartner](), [chainguard-gartner-mq](), [chainguard-libraries](), [container-images](), [gartner](), [gartner-magic-quadrant](), [sboms](), [secure-by-default](), [security](), [software-supply-chain-security](), [software-supply-chain-security-gartner](), [software-supply-chain-security-mq](), [zero-cves]() ### AI overview Chainguard's article discusses its recognition as a Leader in Gartner's inaugural Magic Quadrant for Software Supply Chain Security. It argues that accelerating vulnerability exploitation and AI-assisted development require prevention-oriented, secure-by-default supply chain security. The article highlights Chainguard Containers, which provides minimal container images rebuilt daily from source, with zero CVEs, SBOMs, and verifiable signatures, and briefly introduces Chainguard Libraries. ### Source excerpt Gartner names Chainguard a Leader in Software Supply Chain Security, highlighting its secure-by-default approach and market vision. ## Eliminating Kubernetes Image Signature Replication DevFeed: [Eliminating Kubernetes Image Signature Replication]() Original publisher: [Read original article]() Author: The Kubernetes Authors Published: 2026-06-05T00:00:00Z Content type: article Language: en Sources: [Kubernetes Contributors Blog]() Topics: [Kubernetes](), [Replication](), [container images](), [Routing (disambiguation)](), [Latency](), [Google]() Tags: [cloud](), [container-images](), [cosign](), [kubernetes](), [latency](), [manifest](), [oidc](), [registry](), [replication](), [route](), [routing](), [sha256](), [signing](), [verify]() ### AI overview This article explains how Kubernetes eliminated replication of image signatures across 22 regional registries. Because signatures are small and regional latency is negligible, archeio now routes signature requests to a canonical registry while image layers continue using geo-routing. ### Source excerpt The image promoter rewrite laid the groundwork for simplifying how Kubernetes delivers container image signatures. One of the rewrite phases (Phase 6) separated image signing from signature replication into distinct pipeline stages. This follow-up covers the next step: eliminating signature replication entirely. The problem After promoting container images to registry.k8s.io, the promoter signs them using cosign with keyless (OIDC) signatures. These signatures are stored as OCI artifacts alongside the images, tagged with the convention sha256-.sig and sha256-.att. The registry.k8s.io domain is backed by archeio , a thin redirector that routes container image requests to the nearest regional Google Artifact Registry backend. When a user in Europe pulls an image, archeio redirects them to europe-west2-docker.pkg.dev; a user in Asia gets redirected to asia-east1-docker.pkg.dev, and so on across 22 regional backends. This geo-routing is great for image layers, where download locality matters for performance. But it created a problem for signatures: if the promoter only wrote a signature to one region, cosign verify would fail for users redirected to any other region. The solution was a dedicated replication pipeline that copied every .sig and .att tag to all 22 regional backends. This pipeline ran as a periodic Prow job every 2 hours on weekdays, performing thousands of API calls per run: listing tags across all repositories, diffing what existed where, and copying the missing signatures. The insight Signatures and attestations are small metadata artifacts, typically a few kilobytes each. Unlike image layers where geo-locality provides meaningful download performance improvements, fetching a signature from a non-local region adds negligible latency. The entire replication pipeline existed to optimize for a latency difference that users would never notice. The solution Instead of replicating signatures everywhere, archeio was taught to route signature req ## Building the business case for a secure open source supply chain DevFeed: [Building the business case for a secure open source supply chain]() Original publisher: [Read original article]() Published: 2026-05-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [open-source-security](), [vulnerability management](), [cloud-infrastructure](), [CI/CD](), [distributed-systems](), [container images](), [engineering-culture]() Tags: [chainguard-assemble](), [chainguard-containers](), [chainguard-customers](), [cloud-infrastructure](), [cloud-native](), [compliance](), [container-images](), [continuous-delivery](), [cves](), [dependencies](), [distributed-systems](), [kyndryl](), [kyndryl-open-source](), [open-source](), [productivity](), [resilience](), [secure-open-source](), [software-supply-chain-security](), [supply-chain](), [vulnerabilities]() ### AI overview The article explains how organizations can build a business case for a secure open source supply chain. It describes a shift from framing open source security solely around CVEs, scanner results, and patching toward presenting trusted open source as a driver of productivity, resilience, and delivery speed. It also explains why traditional vulnerability management struggles with continuous delivery, distributed systems, frequently rebuilt container images, changing dependencies, and global cloud infrastructure. ### Source excerpt Learn how Kyndryl reframed open source security as a business driver -- reducing risk, lowering costs, and accelerating developer productivity. ## Chainguard artifacts safe from npm supply chain attack targeting SAP developer dependencies with 2.25M+ monthly downloads DevFeed: [Chainguard artifacts safe from npm supply chain attack targeting SAP developer dependencies with 2.25M+ monthly downloads]() Original publisher: [Read original article]() Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [npm](), [npm packages](), [chainguard](), [GitHub](), [container images](), [Bun](), [Node.js]() Tags: [bun](), [chainguard-containers](), [chainguard-libraries](), [github](), [malicious-packages](), [mini-shai-hulud](), [node-js](), [npm](), [npm-malware](), [npm-worm](), [sap](), [security](), [shai-hulud](), [supply-chain](), [tokens]() ### AI overview A Shai-Hulud-style npm supply-chain attack compromised four SAP Cloud Application Programming Model dependencies with more than 2.25 million combined monthly downloads. The malicious packages used a preinstall hook to download Bun and harvest GitHub tokens, npm tokens, and other developer secrets. Chainguard customers were protected because Chainguard Libraries for JavaScript does not build or serve packages containing install-time scripts, and Chainguard Factory terminated rebuilds when it detected the hook. ### Source excerpt New npm worm targets 2.25M-download packages. Chainguard customers stayed protected by blocking install-time scripts and malicious dependencies. ## Managing third-party images at scale DevFeed: [Managing third-party images at scale]() Original publisher: [Read original article]() Published: 2026-04-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [container images](), [Security](), [Vulnerabilities](), [cloud-infrastructure](), [code productivity](), [chainguard]() Tags: [appian](), [chainguard](), [chainguard-containers](), [chainguard-images](), [chainguard-os](), [cloud](), [compliance](), [container-image](), [container-images](), [containers](), [dependencies](), [developer-velocity](), [fedramp](), [hardened-images](), [scale](), [security](), [third-party-container-images](), [vulnerabilities]() ### AI overview This article explains how Appian approached managing third-party container images at scale with Chainguard. It describes the operational burden caused by image dependencies, vulnerabilities, maintenance, and compliance requirements, including the ongoing work needed for regulated environments such as FedRAMP. It also estimates that building a complete internal hardened-image program would require a dedicated team of 15 to 20 engineers. ### Source excerpt Learn how companies can scale third-party container image management with Chainguard to reduce risk, cut toil, and accelerate compliance and developer velocity. ## The State of Trusted Open Source: March 2026 DevFeed: [The State of Trusted Open Source: March 2026]() Original publisher: [Read original article]() Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Open Source](), [chainguard](), [Artificial Intelligence](), [container images](), [Vulnerabilities](), [Python](), [PostgreSQL]() Tags: [2026](), [ai](), [ai-cve-report](), [ai-vulnerability-report](), [chainguard](), [chainguard-containers](), [chainguard-cve-data](), [chainguard-cves](), [chainguard-data-report](), [container-images](), [cve](), [open-source](), [postgresql](), [python](), [report](), [state-of-open-source](), [state-of-trusted-open-source]() ### AI overview Chainguard's March 2026 State of Trusted Open Source report examines open-source consumption, container image usage, vulnerabilities, and remediation across its customer portfolio. It highlights AI-driven development, growth in Python and PostgreSQL usage, increasing standardization of the modern platform stack, and the use of Chainguard Base for customized developer tooling. ### Source excerpt AI is accelerating software and CVE growth. Chainguard's latest report shows rising risk in the long tail and how teams can stay secure at scale. ## Chainguard introduces Catalog Starter with five free trusted container images DevFeed: [Chainguard introduces Catalog Starter with five free trusted container images]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard catalog starter](), [chainguard catalog](), [container images](), [chainguard containers]() Tags: [chainguard-catalog](), [chainguard-catalog-starter](), [chainguard-containers](), [chainguard-free-tier](), [container-images](), [free](), [free-chainguard-containers](), [free-chainguard-images](), [security]() ### AI overview Chainguard introduces Catalog Starter, a free offering that lets developers choose five trusted container images from the Chainguard catalog for development and production workloads. ### Source excerpt Chainguard Catalog Starter is a new free offering that gives developers instant access to trusted container images from the industry's most comprehensive catalog ## Introducing Chainguard OS Packages: Secure ingredients for custom container builds DevFeed: [Introducing Chainguard OS Packages: Secure ingredients for custom container builds]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard os](), [container images](), [Docker Hardened Images](), [Vulnerabilities](), [Linux](), [Automation](), [Dockerfile](), [Open Source](), [bazel](), [chainguard sboms](), [APK]() Tags: [apk](), [apko](), [automation](), [base-images](), [bazel](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [chainguard-os](), [chainguard-os-packages](), [chainguard-packages](), [chainguard-sboms](), [container](), [container-images](), [cve](), [dockerfiles](), [open-source](), [sboms](), [secure-software-packages](), [software-packages](), [vulnerabilities](), [zero-cve-packages]() ### AI overview Chainguard introduces Chainguard OS Packages, a service providing continuously maintained, enterprise-grade packages and base images for teams that build custom container images. Customers retain control over image composition and build tooling while Chainguard handles package sourcing, rebuilding, vulnerability remediation, and SBOM generation. ### Source excerpt Chainguard OS Packages are enterprise-grade, zero-CVE packages and base images built and continuously maintained in the Chainguard Factory. ## Owning the boundary: Introducing the Chainguard FIPS Provider for OpenSSL 3.4.0 DevFeed: [Owning the boundary: Introducing the Chainguard FIPS Provider for OpenSSL 3.4.0]() Original publisher: [Read original article]() Published: 2026-03-11T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Cryptography](), [container images](), [Security](), [Vulnerabilities]() Tags: [2026](), [chainguard](), [chainguard-containers](), [chainguard-fips](), [chainguard-fips-images](), [cmvp](), [compliance](), [container-images](), [cryptographic](), [cve-remediation](), [fips](), [fips-containers](), [open-ssl-3-4-0](), [updates](), [vulnerabilities]() ### AI overview Chainguard announces the Chainguard FIPS Provider for OpenSSL 3.4.0, validated under CMVP certificate #5132. Beginning March 17, 2026, Chainguard FIPS container images will upgrade to it. The article explains that owning the validated cryptographic module lets Chainguard remediate vulnerabilities within the validated boundary and manage the required resubmission process without depending on third parties. ### Source excerpt Chainguard is the first and only to FIPS-validate OpenSSL 3.4, owning the validated cryptographic module that powers our FIPS images. ## Going deep: Upstream distros and hidden CVEs DevFeed: [Going deep: Upstream distros and hidden CVEs]() Original publisher: [Read original article]() Published: 2026-02-25T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Docker Hardened Images](), [supply-chain-security](), [container images](), [Vulnerabilities](