Chainguard: Building Secure Container Images

Chainguard: Building Secure Container Images

Author: Bret Fisher May 3, 2024 Duration: 59:43

Bret and Nirmal are joined by Dan Lorenc from Chainguard to walk them through Chainguard's approach to building secure, minimal container images for popular open source software.

😇 My new GitHub Security workshop has launched! A free 2-hour workshop with hands-on labs to harden your repos and your workflows from common supply chain attacks. I'll cover how attackers are getting in, and then we'll lock down a sample repo so you know what needs to be done to protect your code. You'll leave with a deep understanding of risks and mitigations as well as a list of helpful tools to keep your repos safe, including my new "gasa" tool for scanning your repos and orgs.

They discuss why it is important to have secure and minimal container images. Dan explains how Chainguard helps remove the pain of CVEs, laggy software updates and patches and much more. Chainguard is now available also on Docker Hub.

They spend the first part of the show talking about the week's big news: the XZ supply chain attack, and Dan was the best man to explain it. They also touch on CVEs, things you can do to reduce the attack surface, SLSA, and more during this jam-packed show.

There's a video version you can watch on YouTube

★Topics★
Chainguard Website
Vulnerability Management Certification course
True Cost of Vulnerability Management
Chainguard Images
Chainguard on Docker Hub Announcement

Creators & Guests

  • (00:00) - Intro
  • (05:14) - Dan's Take on the XZ Hack
  • (14:59) - Chainguard Distro Creation
  • (21:21) - Chainguard in Docker Hub Announcement
  • (24:26) - Free Images vs Private Images
  • (26:27) - Zero CVE Approach
  • (28:33) - Ways to Reduce Attack Surfaces
  • (39:56) - Chainguard Academy
  • (41:08) - Real Time Antivirus Malware Scanner
  • (43:52) - Google Distro Lists Worth Using
  • (45:56) - Chainguard for Buildpacks
  • (46:20) - SLSA
  • (56:08) - What's Next for Chainguard?
  • (56:52) - Getting Started with Chainguard

You can also support this podcast by subscribing to my YouTube channel and my monthly newsletter at bret.news!

Grab the best coupons for my GitHub, Agents, Docker, and Kubernetes courses.
Join my cloud native DevOps community on Discord.
Grab some merch at Bret's Loot Box
Homepage bretfisher.com

★ Support this podcast ★

Bret Fisher hosts DevOps and Docker Talk: Cloud Native Interviews and Tooling alongside Nirmal Mehta, pulling conversations directly from their live audience sessions. This isn't a theoretical lecture series; it's grounded in the practical, often messy realities of building and running modern systems. Each episode digs into the specific tools and philosophies shaping infrastructure today, from the foundational elements like Docker and container orchestration with Kubernetes or Swarm to the broader cultural shifts of DevOps, SRE, and platform engineering. You'll hear discussions that span the entire software lifecycle, touching on the integration of security with DevSecOps, the automation promises of GitOps, and what "Cloud Native" truly means for development teams. The dialogue stays focused on actionable insights and real-world use cases, offering a genuine sense of what works and what doesn't in the field. For anyone navigating the container and cloud ecosystem, this podcast serves as a regular, insightful check-in with practitioners and experts, hosted by someone deeply embedded in the community. The natural, interview-driven format makes complex topics accessible, ensuring listeners come away with more than just buzzwords-they get context and clarity.
Author: Language: English Episodes: 50

DevOps and Docker Talk: Cloud Native Interviews and Tooling
Podcast Episodes
Best of DevOps 2023 [not-audio_url] [/not-audio_url]

Duration: 52:08
Bret and Nirmal are joined by Melissa McKay, Developer Advocate at JFrog and Docker Captain, to discuss the best and worst of 2023.😇 My new GitHub Security workshop has launched! A free 2-hour workshop with hands-on labs…
Faster Dev Feedback and Previews with Livecycle [not-audio_url] [/not-audio_url]

Duration: 37:37
Bret is joined by Matan Mishan & Roy Razon of Livecycle to discuss developer platforms and how to improve developer collaboration and speeding up feedback and previews.😇 My new GitHub Security workshop has launched! A fr…
Docker Recap of 2023 [not-audio_url] [/not-audio_url]

Duration: 55:06
Bret and Nirmal are joined by Michael Irwin, DevRel at Docker, to talk about all the products and features Docker shipped in 2023, and what's coming in early 2024. 😇 My new GitHub Security workshop has launched! A free 2…
Tailscale Everything [not-audio_url] [/not-audio_url]

Duration: 55:06
Bret is joined by Alex Kretzschmar to talk about Tailscale, a universal VPN that connects teams, devices, and development environments for easy access to remote resources.😇 My new GitHub Security workshop has launched! A…
Dockerfiles have versions? [not-audio_url] [/not-audio_url]

Duration: 16:06
I break down why Dockerfile frontends exist and how Docker's build engine "BuildKit" is giving us updated Dockerfile features.😇 My new GitHub Security workshop has launched! A free 2-hour workshop with hands-on labs to h…
Dagger: CI of the Future? [not-audio_url] [/not-audio_url]

Duration: 57:08
Application delivery doesn’t have to suck. Bret and Nirmal are joined by Solomon Hykes, the founder or Docker, to talk about Dagger and their application delivery-as-code that runs anywhere.💥 This episode is brought to y…
Registry is getting an upgrade: Inside OCI artifacts [not-audio_url] [/not-audio_url]

Duration: 20:34
The OCI specifications for registry and image are getting a minor version number update to 1.1 soon, and this could be a big deal for anyone storing artifacts other than images somewhere in their infrastructure. This epi…
KubeCon Live with Friends 2023 [not-audio_url] [/not-audio_url]

Duration: 50:10
Bret is joined by Nirmal and a host of friends from the floor of KubeCon, to talk about the latest news and goings-on.😇 My new GitHub Security workshop has launched! A free 2-hour workshop with hands-on labs to harden yo…
Moving Domain Registrars, Again [not-audio_url] [/not-audio_url]

Duration: 8:11
In this short episode, I tell the tale of my registrar DNS name hosting for the last 25 years and what I prefer for a cheap and reliable name registrar.😇 My new GitHub Security workshop has launched! A free 2-hour worksh…