Sandboxing/Containerizing alternatives to Snap fo...
summary
Claim: Ubuntu produces tiny application-focused container images by slicing Debian packages and installing only needed files, yielding 5 MB images for the .NET example. Implementation uses a separate slicedefinition database and a from-scratch chisel package manager to build package slices (documentation/binaries/config) and resolves slice deps, not full dpkg state. Current builds produce one big layer (no layering yet) and are upstreamed outside Debian, with manual review required for what’s “needed.”
AI-written summary · about
chapters (9)
- 0:00Introduction to container security
- 1:02Why container images need trimming
- 3:54Distroless containers limitations
- 4:59Introducing Chisel Ubuntu images
- 6:28Q&A on chiseling process
- 14:36Slicing packages into smaller units
- 17:01Implementation details of Chisel
- 18:37Layered images and future plans
- 20:05Closing remarks and thanks
related talks
40m"Willy Wonka and the Secure Container Factory"
01h 25mSandboxing a Linux Application
29m5 Best Security Practices for your Production-Ready Containers
29m5 Security Best Practices For Production Ready Containers
39mA Journey to Distroless
55mRecipes and Runtimes: Making Sense of Containers in 2026
20mCreating Production Ready Containers: What Devs Need to Know to Secure Their Containers
38mSandboxing in Linux with zero lines of code