Video on

What is the Chainguard Factory?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: So Dustin, can you explain what the Chainguard Factory is?

Debugging Distroless Containers with Docker Debug

Fri, 26 Jan 2024 01:21:01 +0000

Tools used in this video

Docker Desktop (Note a paid subscription is required.)

Transcript

Hey folks, I wanted to record a short video explaining how you can debug container images, even distroless ones.

What does the Chainguard Factory build?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: So Dustin, what does the Factory actually build every day?

Touring the Chainguard Factory

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: So Dustin, can you give us a quick tour of the Chainguard Factory?

How Chainguard Creates Container Images with Low-to-No CVEs

Fri, 31 May 2024 12:21:01 +0000

Tools and resources used in this video

Note: In November 2024, after this article was first written, Chainguard made changes to its free tier of container images. In order to access the non-free container images used in this guide, you will need to be part of an organization that has access to them. For a full list of container images that will remain in Chainguard's free tier, please refer to this support page.

Can anybody build Chainguard Containers themselves?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: But everything is open source—can anybody build the images themselves?

Beyond Zero: Eliminating Vulnerabilities in PyTorch Container Images (PyTorch 2024)

Sat, 07 Sep 2024 01:21:01 +0000

Recording of Beyond Zero: Eliminating Vulnerabilities in PyTorch Container Images presented by Dan Fernandez, Srishti Hegde, and Patrick Smyth at PyTorch 2024

Session Description

Container images are increasingly the future of production applications at scale, providing reproducibility, robustness, and transparency. As PyTorch images get deployed to production, however, security becomes a major concern. PyTorch has a large attack surface, and building secure PyTorch images can be a challenge. Currently, the official PyTorch runtime container image has 1 CVE (known vulnerabilities) rated critical and 5 CVEs rated high. Improving this situation could secure many deployments that incorporate PyTorch for cloud-based inference or training. In this fast-paced session, we took a deep dive on the official PyTorch image from a vulnerability mitigation perspective, looking hard at included packages, executables, and active CVEs. We identify low-hanging fruit for increasing security, including stripping bloat and building fresh. We also talk about the next level of security practiced in Chainguard’s PyTorch image builds, such as including SBOMs and going distroless. Finally, we consider emerging tools and approaches for analyzing AI artifacts such as models and how these systems can benefit PyTorch in production.

What is the future of the Chainguard Factory?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: So what do you see as the future for the Factory?

How does Chainguard Libraries plug into a developer's workflow?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: So Dustin, how does Libraries actually plug into a developer workflow?

How does Chainguard Libraries help developers?

Sat, 02 Aug 2025 16:00:00 +0000

Transcript

Interviewer: So how does Chainguard Libraries help developers?

Inside the Chainguard Factory - Assemble 2025

Thu, 31 Jul 2025 16:00:00 +0000

Transcript

Sam (Introduction): We’re very fortunate our Vice President of Engineering, Dustin Kirkland, is going to be walking us through the Chainguard Factory, which you would have heard a little bit about during the keynote today. So I’ll go ahead and turn things over to Dustin. We will have time at the end for questions, so keep that in mind. Thank you.

Updating Container Images with Renovate (and no PATs!)

Tue, 23 Dec 2025 09:30:00 +0100

In this video, Developer Relations Engineer Adrian Mouat shows you how you can update container images using Renovate with Octo STS, eliminating the need for GitHub Personal Access Tokens.

Video

What You’ll Learn

How to set up Renovate as a GitHub Action
Using Octo STS to eliminate Personal Access Tokens
Configuring trust policies for automated workflows
Setting up assumable identities for private registries
Automating container image and GitHub Actions updates

Transcript

In this video, I’m going to show you how you can use Renovate to update container images and GitHub actions. At Chainguard, we do talk a lot about the need to keep software up to date. And in my opinion, it’s essential you do that for both security and maintainability. So, if you stay on an old version of a package for too long, there’s a strong chance that you’ll be bitten by an unpatched vulnerability. But also, the longer you stay on an old version, the harder updating becomes. So, it’s much better to do frequent small updates than it is to occasionally be forced into having to do major breaking updates.

Using the Chainguard Static Base Container Image

Wed, 30 Aug 2023 15:21:01 +0000

Tools used in this video

Docker
Grype

Dockerfile

FROM cgr.dev/chainguard/go AS build
COPY main.go /main.go
RUN CGO_ENABLED=0 go build -o /hello /main.go
FROM cgr.dev/chainguard/static
COPY --from=build /hello /usr/local/bin/
CMD ["hello"]

Transcript

So what’s the best container base image to use?

How to Use Container Image Digests to Improve Reproducibility

Mon, 07 Aug 2023 15:21:01 +0200

Tools used in this video

Docker
Crane

Commands used

docker pull cgr.dev/chainguard/node

docker manifest inspect cgr.dev/chainguard/node@sha256:ede7ef4ca485553f5313f7a02ad3537db1fe337079fc7cfb879f44cf709326db

crane digest --full-ref cgr.dev/chainguard/node

docker pull cgr.dev/chainguard/node:latest@sha256:ede7ef4ca485553f5313f7a02ad3537db1fe337079fc7cfb879f44cf709326db

Dockerfile

FROM cgr.dev/chainguard/go:latest@sha256:7e60584b9ae1eec6ddc6bc72161f4712bcca066d5b1f511d740bcc0f65b05949 AS build
WORKDIR /src
RUN CGO_ENABLED=0 go build -o /bin/server ./src
FROM cgr.dev/chainguard/static AS prod
COPY --from=build /bin/server /bin/
EXPOSE 8000
ENTRYPOINT [ "/bin/server" ]

Transcript

0:05 You might have heard the advice to pin to a digest when using container images.

Reproducible Dockerfiles with Frizbee and Digestabot

Fri, 07 Jun 2024 12:21:01 +0000

Tools

Transcript

I’d like to talk about a problem I faced with container builds in the past and a potential solution.

Getting Software Versions from Chainguard Containers

Fri, 07 Jul 2023 15:21:01 +0200

Tools used in this video

Commands used

cosign download attestation --platform=linux/amd64 \
--predicate-type=https://spdx.dev/Document \
cgr.dev/chainguard/python:latest | jq -r .payload | base64 -d \
| jq -r '.predicate.packages[] | "\(.name) \(.versionInfo)"'

docker run cgr.dev/chainguard/wolfi-base ls /var/lib/db/sbom

Transcript

Hi, I want to record a very short video on how to get software version information out of Chainguard Containers.

Building Minimal Container Images for Applications with Runtimes

Wed, 06 Sep 2023 01:21:01 +0000

Tools used in this video

Docker

Resources

The Dockerfiles used in this video and other supporting documentation are available on GitHub.