7 ms·

I work at Chainguard, happy to answer any questions!

by dlor 3y ago

Operyl 3y ago
EDIT: upon using dockerhub’s organization page for a bit, and realizing there’s no search on the organization page (I swear there was?), I now understand. Why does the article present this bizarre set of instructions for grabbing the image instead of linking directly? You could just link your organization no? > Getting started with Chainguard Developer Images in Docker Hub is easy. Follow these simple steps: > Look up the Image you want. > Select ‘Recently Updated’ from the dropdown menu on the right. > Filter out the community images by selecting the filter ‘Verified Publisher.’ > Copy the pull command, paste it into your terminal, and you are all set.
- dlor 3y ago
  Good callout, if you know how to use docker and and dockerhub then it's just as easy as `docker pull chainguard/node`
jamesdwilson 3y ago
If a primary goal of a consumer of the images is security, how can we trust the images not to have backdoors or virusesesses [extra s added for comedy]?
- dlor 3y ago
  Great question! We take hardening of our build infrastructure very seriously, and helped build many of the OSS technologies in this space like the SLSA framework and the Sigstore project. We produce SBOMs during the build process, and cryptographically sign SLSA-formatted provenance artifacts depicting the entire build process so you can trace a built container all the way back to the sources it was built from. We also try to make as much of our build system reproducible as possible (but we're not all the way there yet), so you can audit or rebuild the process yourself.
- tuananh 3y ago
  The images repo is here https://github.com/chainguard-images/images https://github.com/chainguard-images/images
remram 3y ago
I read the blog, then I clicked on the big "back" button at the top labeled "Unchained" and read that, then I went to your homepage and read that, then I clicked "get started" and read that page too. I still have no idea what Chainguard is, or what those images do. All I know is those images are "hardened", is that the only thing they're for? Is that Chainguard's product?
- dlor 3y ago
  Yep, that's it - the product is hardened container images!
- jacques_chester 3y ago
  Not at Chainguard but I've watched their growth. I think this comes down to audience. To a lot of engineers it's just like ... "OK, that's nice. What else?" But for security teams in large enterprises, Chainguard is like manna from heaven. They immediately understand what is really being sold: the elimination of enormous amounts of compulsory toil due to upgrading vulnerable software -- or having to nag other teams to do it. It's a bit like visiting the site of a medical devices manufacturer. I probably don't know what the device does, but the target audience sure do.
  - candiddevmike 3y ago
    > But for security teams in large enterprises, Chainguard is like manna from heaven. They immediately understand what is really being sold: the elimination of enormous amounts of compulsory toil due to upgrading vulnerable software -- or having to nag other teams to do it. Explain to me how Chainguard helps with this. Everywhere I've worked, this process has very specific needs depending on the companies internal and regulatory requirements. Chainguard may help with proof of origin/base imaging, but it doesn't do much beyond what container registries and tools like dependabot/snyk/dependency track already provide (not saying they're directly related), which doesn't really reduce that much toil.
    - jacques_chester 3y ago

I work at Chainguard, happy to answer any questions!

by dlor 3y ago

I work at Chainguard, happy to answer any questions!

EDIT: upon using dockerhub’s organization page for a bit, and realizing there’s no search on the organization page (I swear there was?), I now understand. Why does the article present this bizarre set of instructions for grabbing the image instead of linking directly? You could just link your organization no? > Getting started with Chainguard Developer Images in Docker Hub is easy. Follow these simple steps: > Look up the Image you want. > Select ‘Recently Updated’ from the dropdown menu on the right. > Filter out the community images by selecting the filter ‘Verified Publisher.’ > Copy the pull command, paste it into your terminal, and you are all set.

dlor 3y ago
Good callout, if you know how to use docker and and dockerhub then it's just as easy as `docker pull chainguard/node`

jamesdwilson 3y ago

If a primary goal of a consumer of the images is security, how can we trust the images not to have backdoors or virusesesses [extra s added for comedy]?

dlor 3y ago
Great question! We take hardening of our build infrastructure very seriously, and helped build many of the OSS technologies in this space like the SLSA framework and the Sigstore project. We produce SBOMs during the build process, and cryptographically sign SLSA-formatted provenance artifacts depicting the entire build process so you can trace a built container all the way back to the sources it was built from. We also try to make as much of our build system reproducible as possible (but we're not all the way there yet), so you can audit or rebuild the process yourself.
tuananh 3y ago
The images repo is here https://github.com/chainguard-images/images https://github.com/chainguard-images/images

remram 3y ago

I read the blog, then I clicked on the big "back" button at the top labeled "Unchained" and read that, then I went to your homepage and read that, then I clicked "get started" and read that page too. I still have no idea what Chainguard is, or what those images do. All I know is those images are "hardened", is that the only thing they're for? Is that Chainguard's product?

dlor 3y ago
Yep, that's it - the product is hardened container images!
jacques_chester 3y ago
Not at Chainguard but I've watched their growth. I think this comes down to audience. To a lot of engineers it's just like ... "OK, that's nice. What else?" But for security teams in large enterprises, Chainguard is like manna from heaven. They immediately understand what is really being sold: the elimination of enormous amounts of compulsory toil due to upgrading vulnerable software -- or having to nag other teams to do it. It's a bit like visiting the site of a medical devices manufacturer. I probably don't know what the device does, but the target audience sure do.
- candiddevmike 3y ago
  > But for security teams in large enterprises, Chainguard is like manna from heaven. They immediately understand what is really being sold: the elimination of enormous amounts of compulsory toil due to upgrading vulnerable software -- or having to nag other teams to do it. Explain to me how Chainguard helps with this. Everywhere I've worked, this process has very specific needs depending on the companies internal and regulatory requirements. Chainguard may help with proof of origin/base imaging, but it doesn't do much beyond what container registries and tools like dependabot/snyk/dependency track already provide (not saying they're directly related), which doesn't really reduce that much toil.
  - jacques_chester 3y ago