Secure Container Images with Chainguard's Tooling: Melange, Apko & Wolfi
summary
Shows how Melange packages a Go service into a signed APK with an SBOM, then how Apko & Wolfi build a declarative runtime image from those APKs so every OS package and app binary is signed and auditable. Demo builds an HTTP-logging Go binary, produces SBOMs, pushes an OCI image and runs a local proxy; node base images can contain over 5,300 files, while a static distroless can be ~2.5MB. CA bundles are handled separately and image attestations go to a public transparency log.
AI-written summary · about
chapters (6)
- 0:00Intro
- 1:00Container images
- 14:13How do you build container images?
- 20:33Apko - Custom distroless
- 32:19Demo
- 48:27Outro
related talks
30mBuilding minimal images with Wolfi OS, declaratively with melange and apko
37mSupply Chain Security in Kubernetes
28mBuilding Images for the Secure Supply Chain
24mStart Securing your Base Images by Making your Own Distroless
36mContainer Images & Security 101: 5 Need to Know Facts
07mContainer Hardening with Paketo and Wolfi
39mA Journey to Distroless
20mSponsored Demo: Secure, Portable, Operable: A Strategy for Modern Services