How Chainguard builds and tests containers on

Chainguard criteria for determining whether to build a container image

Mon, 13 Jan 2025 11:07:52 +0200

There are currently over 2,000 Chainguard Containers and that number is always growing as we add more to our expanding catalog.

If you would like a Chainguard Container that is not yet available, or inquire about whether we would build a given container image, Chainguard will endeavor to perform an analysis on the request. Chainguard aims to build new container images that are relevant to our customers and to support broader software security goals. However, it is not always feasible to package and build software. Please note that we have the following general criteria when considering requests.

How Chainguard Containers are tested

Thu, 21 Mar 2024 11:07:52 +0200

Chainguard Containers are minimal, distroless container images that you can use to build and run secure applications. Given the importance of secure, highly performant images, Chainguard performs testing to ensure our container images match the functionality of upstream and other external counterparts.

This article provides a high-level overview of Chainguard’s approach to testing when building new container images to ensure their security and consistency with comparable container images.

Build requirements for new container images

Chainguard has a set of requirements in place that new container images must meet in order to be included in our Containers Directory. These requirements fall into two categories:

Reproducibility and Chainguard Containers

Mon, 20 May 2024 12:21:01 +0000

A build is reproducible when the same inputs produce the same output, bit for bit, regardless of who runs it and when they run it. Chainguard builds its containers with apko from a declarative configuration, and publishes that configuration as a signed attestation on every build. You can retrieve the configuration, rebuild the container yourself, and check the digest you get against the one Chainguard published.

What reproducibility requires

Reproducibility requires more than a build that succeeds twice. Binary identical means every byte matches, so a reproducible build has to control three things: