Languages and runtimes on

Getting started with the C/C++ Chainguard Containers

Tue, 30 Jul 2024 15:54:33 +0000

Chainguard provides security-hardened container images for C and C++ development, offering minimal runtime environments with significantly reduced vulnerabilities compared to traditional base images. Built on Chainguard’s own OS, these containers enable more secure deployment of compiled programs through purpose-built images for different linking scenarios. This guide demonstrates three approaches to compiling and running C/C++ applications using Chainguard’s specialized containers.

The container image with which you choose to run your compiled program depends on the nature of your binaries. Static binaries can be executed in the minimal static Chainguard Container, while dynamically linked binaries can be run in the glibc-dynamic Container. For this demonstration, you will first compile a C binary using the gcc-glibc Chainguard Container, and then learn how to use a multi-stage build to run the resulting binary in the glibc-dynamic image. You’ll also cover an example showing the multi-stage build process for the C++ programming language. To learn more about the differences between these container images, read our article on Choosing a container for your compiled programs.

Getting started with the Go Chainguard Container

Tue, 28 Feb 2023 11:07:52 +0200

Chainguard’s Go container image provides a secure foundation for building Go applications. The distroless latest variant contains only the Go compiler and runtime, while the latest-dev variant includes additional build tools and package management capabilities for development workflows.

In this guide, we’ll demonstrate how to build and execute Go applications using Chainguard Containers, using three examples from our demos repository. In the first example, we’ll build a CLI application using a Docker multi-stage build. In the second example, we’ll build an application that’s accessible by HTTP server, also using a Docker multi-stage build to obtain an optimized runtime. The third example shows how to build an image using ko, a tool that enables you to build container images from Go programs and push them to container registries without requiring a Dockerfile.

Getting started with the Laravel Chainguard Container

Fri, 17 May 2024 11:07:52 +0200

Chainguard’s Laravel container image provides a secure foundation for Laravel applications with minimal vulnerabilities compared to traditional PHP images. This specialized image includes all necessary PHP extensions and tooling for Laravel development while maintaining Chainguard’s security-first approach, enabling developers to build complex applications without compromising on security.

In this guide, we’ll set up a demo and demonstrate how you can use Chainguard Containers to develop, build, and run Laravel applications.

This tutorial requires Docker to be installed on your local machine. If you don’t have Docker installed, you can download and install it from the official Docker website.

Getting started with the Node Chainguard Container

Wed, 01 Feb 2023 11:07:52 +0200

Chainguard’s Node container image provides a secure runtime for Node.js applications. This distroless image includes Node.js and npm while maintaining a minimal attack surface for production deployments.

In this guide, we’ll set up a demo application and create a Dockerfile to build and execute the demo using the Node Chainguard Containers as base.

This tutorial requires Docker, Node, and Npm to be installed on your local machine.

What is distroless?

Distroless container images are minimal container images containing only essential software required to build or execute an application. That means no package manager, no shell, and no bloat from software that only makes sense on bare metal servers.

What is Wolfi?

Wolfi is a community Linux undistro created specifically for containers. This brings distroless to a new level, including additional features targeted at securing the software supply chain of your application environment: comprehensive SBOMs, signatures, daily updates, and timely CVE fixes.

What are multi-stage builds?

Multi-stage builds are a Docker feature that allow you to use multiple FROM statements in a single Dockerfile, where each statement begins a new build stage. In a typical pattern, an early stage uses a full-featured builder image to compile code or generate artifacts, while a later stage uses a minimal runtime image and copies in only what's needed to run the application. Only what you explicitly copy from one stage carries forward — everything else is discarded when that stage completes.

Getting started with the PHP Chainguard Container

Mon, 09 Jan 2023 11:07:52 +0200

Chainguard’s PHP container images provide secure foundations for PHP applications with minimal vulnerabilities compared to traditional PHP images. These images come in multiple variants: the latest-fpm variant for serving web applications via FastCGI, the latest variant for CLI applications, and development variants that include additional tools for building and debugging PHP workloads.

In this guide, we’ll set up a demo and demonstrate how you can use Chainguard Containers to develop, build, and run PHP applications.

Getting started with the Python Chainguard Container

Tue, 28 Feb 2023 11:07:52 +0200

Chainguard’s Python container images provide a more secure foundation for Python applications through distroless design, containing significantly fewer CVEs compared to traditional Python images. These production-ready images are optimized for building and running Python workloads.

Two variants of Chainguard Python images are available: a minimal runtime image containing only Python and its standard library, and a -dev variant that includes pip and a shell for development purposes. Since most Python applications require third-party packages, the recommended approach is using a multi-stage Docker build with the -dev image for dependency installation and the minimal image for runtime.

Getting started with the Ruby Chainguard Container

Wed, 10 May 2023 11:07:52 +0200

Chainguard’s Ruby container images provide secure foundations for Ruby applications with minimal vulnerabilities through both development and production-ready distroless variants. These images significantly reduce attack surface compared to traditional Ruby base images while maintaining full compatibility with Ruby applications and the Rubygems ecosystem.

Because Ruby applications typically require the installation of third-party dependencies via Rubygems, using a pure distroless image for building your application would not work. In cases like this, you’ll need to implement a multi-stage Docker build that uses one of the -dev images to set up the application.