Sessions
GOTO Amsterdam 2023

Wednesday Jun 28
11:20 –
12:10
Administratiezaal

Building Secure & Auditable Container Images Using Chainguard's Tooling: Melange, Apko & Wolfi



This video is also available in the GOTO Play video app! Download it to enjoy offline access to our conference videos while on the move.

Available in Google Play Store or Available in Apple App Store




Using minimal container images with known, auditable contents (the much-hyped SBOM) is a critical part of taking control of your supply-chain security. These images are smaller, more up-to-date, and more secure. You might have started down this path by using multi-stage builds and scratch or distroless base images. Recently, Chainguard has released a set of tooling that takes this to the next level. In this practical session, Matt will walk you through using these tools, showing you how to make small, minimal images, along with SBOMs for their entire contents. He will show how to publish these images, and submit their build attestations to an immutable public audit log. As a bonus, he'll also show how to manage ca-certs in container images, keeping them up-to-date and avoiding the dodgy ones which show up with surprising regularity.

containers
Melange
Apko
Wolfi