[debarshri]

This is great. I have been talking to quite some vendors in the space. I have looked in docker hardened images too. They have made it free too.

I think the problem in general is hardened image market is keeping up with CVEs and making sure the catalog is vast so that it covers all the images and nuances.

Responding and patchibg CVEs with an SLA is the KPI of the vendors. As much as I would like cheer for you, doing it as an opensource initiate with a guaranteed SLA is going to be painful for you as maintainer without profit as a motive.

[ritvikarya98]

Thanks for looking into this! I agree with you and hence I'm also relying on Wolfi packages, which will ensure they are updated as soon as upstream is available so I'm piggy backing on that. Github Actions run daily/weekly based on the cadence and once the pipeline is setup do not require a significant effort imo. And I want it to be community driven so we can add images as and when people want it and build it accordingly. Chainguard tools surely help with this! I aim to show that companies can try and build internal pipelines like this for all images in their repository

[hobofan]

Isn't this mostly the same thing that Chainguard already provides themselves? E.g. the "Free" images on their page [0] have a big overlap with the toolchains from your repo.

[0]: https://images.chainguard.dev

[ritvikarya98]

Some images do overlap yes, but they are some of the most popular ones used and I wanted to demonstrate how they can be build as well. Half of them are only available through paid versions. I will be adding new images on regular basis, based on usage and impact.

[Imustaskforhelp]

> Some images do overlap yes, but they are some of the most popular ones used and I wanted to demonstrate how they can be build as well. Half of them are only available through paid versions. I will be adding new images on regular basis, based on usage and impact.

This looks really good. Good luck for your project!

Also a quick question but when you mention Minimal being well.. Minimal? How much more minimal would it be compared to say alpine?

Also maybe I should stop saying so many times minimal in this comment haha!

[ritvikarya98]

I think it depends on your use case, an image can be as small as default static, but if you need more, we need to add packages. Minimal images make sure we do that with least attack surface.

[hobofan]

Ah, nice! I also just tried to look up how the official Chainguard images are built, and while the are open source they are less straightforward to follow.

I was looking into how to create more secure container image and this looks like a great resource! :)