Building minimal images with Wolfi OS, declaratively with melange and apko
summary
Builds a minimal Python image from source with Wolfi OS using melange to produce APKs and apko to compose an OCI image, emits an aggregated SBOM embedded in the artifact, and reproduces the same digest on rebuild. Demonstrates smaller image size, fewer CVEs in Wolfi versus mainstream bases, explicit package layering, and that declared packages (not dropped binaries) appear in the SBOM; the scripted demo completes successfully and the image runs.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:04Supply chain vulnerabilities
- 3:52Vulnerability scanner limits
- 8:47Live demo: image manipulation
- 13:23Trust needs verification
- 15:08Cosign and SLSA frameworks
- 16:33Reproducibility solves trust
- 16:55Introducing melange, apko, Wolfi
- 21:29Minimal images with melange and apko
- 24:42Building Python image step-by-step
- 27:11Inspecting OCI image
- 27:54Wolfi OS image benefits
- 29:39Conclusion
related talks
49mSecure Container Images with Chainguard's Tooling: Melange, Apko & Wolfi
24mStart Securing your Base Images by Making your Own Distroless
07mContainer Hardening with Paketo and Wolfi
39mA Journey to Distroless
33mBuilding Images For The Secure Supply Chain
33mEnabling VEX and Full SBOM Coverage with Wolfi Based Containers
01h 15mEvaluation of OSS Options to Build Container Images- 33mEnabling VEX and Full SBOM Coverage with Wolfi Based Containers