Chainguard

My main use case for Chainguard Containers is both hardened images and packages.

A specific example of how I use hardened images and packages in my work is that all the microservices I ship to production are based on the slim version of Chainguard, mostly Node and Python. The repository, which is mostly the packages of Python and NPM, is gained from Wolfy. The base is always Chainguard to reduce the attack surface.

I leverage Chainguard Containers by pinning the digest for any Chainguard version of an image to ensure the path from development proof of concept to production remains the same. Chainguard does not have immutable images, as they keep changing even the minor version or the major one, which has reduced my attack surface and the number of vulnerabilities by close to 85%.

Chainguard Containers have positively impacted my organization with respect to overall supply chain attack prevention because Chainguard also provides the software bill of material shipped with my image and signs the images. This level of checking during the actual runtime validates that the package is actually coming from a validated and secure source, which can be confirmed not just at build time but also at runtime.

Since using Chainguard Containers, there has been close to an 85% reduction in vulnerabilities. I manage close to 17 or 18 products that are generally deployed in one of either environment daily. I have controls to gather and set a threshold of vulnerabilities, blocking any workload or application if a vulnerability is found beyond that threshold. After using Chainguard, the number of workloads blocked by those proactive checks has reduced because vulnerabilities in the base images have also decreased.

I believe the best feature Chainguard Containers offers is proactively monitoring a vulnerability before it is even published by the major vulnerability databases and already having a fix for it before it gets alerted by major CVE databases.

The early detection and fix process impacts my day-to-day work as I have had the problem of having many vulnerabilities because I use Wiz as a security posturing tool. It generally scans my workloads and proactively identifies a lot of vulnerabilities that could cause an unsecure workload. With Chainguard, that frequency has reduced, and the number of vulnerabilities has greatly come down.

Chainguard Containers does not just offer the slim version; they also offer the dev variant and the normal variant in case I want to debug. I am not constrained to always use the slim version. In a lower environment, I can target a dev or a more broader version, but it is still hardened to a standard that is better than the open registry providers and image providers.

Chainguard Containers can be improved because they come at a price, which may not be available for an independent developer to test. I am not aware if free versions are available, but they currently come with a license. A free tier available for independent people to test and develop would greatly help in providing feedback on what Chainguard could improve.

I have noted that there are not like-to-like images available. For example, in the case of Python, the image versions available in PyPI are more than what is available in Chainguard. Sometimes there is difficulty in finding or doing an alternate of what I want to do with PyPI and what is available in Chainguard.

I have been using Chainguard Containers for two years.

Chainguard Containers are stable, as I have not seen any container or package crashing in two years.

The scalability of Chainguard Containers is positive as it is a side effect of having fewer vulnerabilities in my workload. The efficiency of my team is increasing, allowing that time to be invested into shipping out more workloads as needed instead of fixing security issues.

I have not used customer support very broadly, but they have generally been very responsive.

I was generally using open-source images before, so I did not switch from a private solution.

I was using distroless images previously, not from public repositories.

I have seen a return on investment in terms of time saved and efficiency increased due to the reduction in security issues that are trivial to go through the entire internet to find and test remediation. There is an 85% reduction in vulnerabilities.

On a scale of 1 to 10, I would rate Chainguard Containers an eight.

I choose an eight because there are still things to do. To have 10 would mean having zero vulnerabilities even in the images available, which is not the case. The fact that I have seen an 85% reduction matches with my mapping of that 85% to an eight.

Chainguard Containers are deployed in my organization using AWS cloud.

My advice for others looking into using Chainguard Containers is to start by not opting for the slim one directly. It all depends on the workload dependencies and package requirements, so I recommend starting with the dev version and gradually rolling out to the slim ones.

Public Cloud

Amazon Web Services (AWS)

What do you like best about the product?

The approach to security in Chainguard product is a gamechanger. It enables developers and engineering to focus on the work that really matters while relying on Chainguard to cover all our security concerns around images and libraries and with trust that any vulnerability found will be resolve quickly allowing us to comply with all our policies.

What do you dislike about the product?

Not many downside, they keep adding support for new images, charts and libraries in many languages, so any missing ends up being supported in some time.

What problems is the product solving and how is that benefiting you?

Chainguard carries all the work to resolve image and libraries vulnerabilities for us. We can trust it to solve any vulnerability within a small timeframe of it being disclosed. And they give us thinner versions of all popular images and libraries that leave less exposed and more secure.

What do you like best about the product?

Secure based container image, interestingly it has vast variety of the pre-built images from database like Postgres, MySQL to language like Java, Go, Python and Node. Images are very small, also difference between dev image for building and image to run in production very secure.

What do you dislike about the product?

Sometimes it’s very hard to port an Ubuntu-based image to Chainguard. Support also feels a little pricey for what you get.

What problems is the product solving and how is that benefiting you?

Applying manual OS-level security patches on base images and language security patches is very time-consuming. It takes a lot of time and ensures our system is very secure.

What do you like best about the product?

The overall offering follows a solid, consumer-friendly pattern: there is enough basic information available to get initial insights, and then a fully detailed level of information behind the paywall (which is fine, since that is their product). The web interface and the console interface for searching, viewing, and deep-diving into their deliverables are really good and work like a charm. The overview, as well as the integration into our artifact management system, was about as easy as it could be.

From a pricing perspective, it would not be realistic to do this on your own at lower cost, and building up the required expertise would already overwhelm most companies.

Regarding onboarding, support, and help, we even had a dedicated person during the first weeks, before it switched over to the standard support channels.

What do you dislike about the product?

Right now, the focus seems to be on containers and Helm charts. Adding some attention to bare VM images as well would be very beneficial.

What problems is the product solving and how is that benefiting you?

They fix CVEs in the OS and, when possible, at the application layer as well. This saves an immense amount of time compared to using open-source containers pulled from the internet.

With regulations like NIS2 and the CRA, this is becoming an obligation that will affect every software company.

What do you like best about the product?

Good communication and good support. They are easy to reach whenever I need help.

What do you dislike about the product?

So far, everything has been fine, and I don’t have anything to complain about.

What problems is the product solving and how is that benefiting you?

Avoid spending time fixing CVEs. Fixing CVEs is not part of Vanderande’s business.