Posted by dimastopel 2 days ago
An easy comparison is wolfi, which is completely open source.
I believe that they will always supply the bleeding edge stable release, but it will always be your responsibility to monitor and manage issues like CVEs, rather than expecting them to do it for you.
By CVEs I mean the architectural stuff that was discovered after the original ingress-nginx repo was archived, so there is no "official" mitigation and it's not just a matter of bumping dependencies, the fixes are actual code.
Chainguard forked the repo and is maintaining their own distribution now, but it's not free.
The point is that you can just use these images instead of what you already have and reduce your vulnerabilities by 97%+ on average.
Think Docker Hub, just without the vulnerabilities.
From my threat attack model, you're just yet another liability - one single service to hack all your "safe" images.
Respect your viewpoint and if these images aren't for you, that's totally fine of course. Many others find it useful to have someone else doing the commoditized but hard work of building thousands of components from source continuously, assembling them into ready to run images, signing, and being as open as possible about their state and configuration as possible.
Edit: honestly I'm flagging this post. This really looks like fishing for customers to make them vulnerable in future.
Alpine/debian packages show you the code that compiles the package from source, do you have that as well?
They’re all normal, OCI compliant images. You can pull them, run them, and build on them like you would any other image.
arm64 and amd64 builds for everything
You surely mean "without known and reported vulnerabilities". I doubt you're proactively fixing the world across thousands of software packages /s
You can also review the different SBOMs for the amd64 and arm64 images, for example - https://images.minimus.io/gallery/images/python-fips/lines/3...
- Chainguard Images
- Chainguard Libraries
- Chainguard VM
...
With Minimus Community Edition, you now have access to 1,000s of built from source, near 0 CVE images without cost or friction