Dan Lorenc, from Chainguard, shares insights on creating secure container images, emphasizing the importance of minimalism to enhance security. He discusses the ramifications of the recent XZ supply chain attack and how Chainguard addresses vulnerability management. Dan highlights the benefits of their zero CVE approach, the launch of Chainguard images on Docker Hub, and the need for proactive security practices. He also elaborates on tools for reducing attack surfaces and the significance of frameworks like SLSA in bolstering software security.
59:43
forum Ask episode
web_stories AI Snips
view_agenda Chapters
auto_awesome Transcript
info_circle Episode notes
question_answer ANECDOTE
Long-Term Supply Chain Attack Story
A nation state actor patiently gained maintainer control of XZ over two years to inject a stealthy backdoor.
The backdoor leveraged cryptographic keys for exclusive access and was discovered by pure luck due to performance issues.
insights INSIGHT
Source Package Verification Gap
The critical gap in supply chain security is the missing verification link between source repo code and distributed source packages.
The XZ attack exploited this by hiding malware in the source upload, not the Git repository.
volunteer_activism ADVICE
Chainguard Images on Docker Hub
Chainguard now mirrors its free baseline container images to Docker Hub for maximum accessibility.
Users can verify image signatures and digests to avoid supply chain compromises when pulling from Docker Hub.
Get the Snipd Podcast app to discover more snips from this episode
Bret and Nirmal are joined by Dan Lorenc from Chainguard to walk them through Chainguard's approach to building secure, minimal container images for popular open source software.
🙌 My next course is coming soon! I've opened the waitlist for those wanting to go deep in GitHub Actions for DevOps and AI automation in 2025. I'm so thrilled to announce this course. The waitlist allows you to quickly sign up for some content updates, discounts, and more as I finish building the course. https://courses.bretfisher.com/waitlist 🍾
They discuss why it is important to have secure and minimal container images. Dan explains how Chainguard helps remove the pain of CVEs, laggy software updates and patches and much more. Chainguard is now available also on Docker Hub.
They spend the first part of the show talking about the week's big news: the XZ supply chain attack, and Dan was the best man to explain it. They also touch on CVEs, things you can do to reduce the attack surface, SLSA, and more during this jam-packed show.
DevOps and Docker Talk: Cloud Native Interviews and Tooling