I'm not sure what problem this is solving. This seems like chainguard but being built in "your ci" (github) vs "their ci". Images may be a bit smaller, but this is already a feature set that wolfi already allows for. Besides that chainguard is not full-source bootstrapped.
Show HN: Minimal – Open-Source Community driven Hardened Container Images
21–30 of 33 posts
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#22I have been curious on secure base images for the AI ecosystem, where we need to ship with cuda 11.8/12.8/13.1 for stability reasons, and in our case, a bit of the torch ecosystem and Nvidia rapids ecosystem. That ends up being... A lot. Extra fun: going all the way to FIPS..
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#23What is the process to trust the usage of this?
How can we learn the identity of the contributors? How are the contributors vetted? How are we notified if a significant change in leadership happens?
It's just a general problem when relying on GitHub accounts for important code.
For some reason I trust the big vendors to have better safe-guards against things like the questions above. Such as aws linux containers etc..
Would love to hear how other people think around this.
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#24I'm not sure what problem this is solving. This seems like chainguard but being built in "your ci" (github) vs "their ci". Images may be a bit smaller, but this is already a feature set that wolfi already allows for. Besides that chainguard is not full-source bootstrapped.
From reading the project readme, I think this demonstrates creating any image you want using Chainguard's tools including commercial ones.
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#25Earlier quoted context omitted.
Joel a little offtopic but looks like we have bumped into each other 3 times now (I remember you from VM comment and then today on a different comment and now this) I am curious to ask now but why do you end every message with =3 & when did you start with this trend, really curious now xD
Don't worry about it... =3
yeah, really curious at this point.
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#26Earlier quoted context omitted.
Some images do overlap yes, but they are some of the most popular ones used and I wanted to demonstrate how they can be build as well. Half of them are only available through paid versions. I will be adding new images on regular basis, based on usage and impact.
> Some images do overlap yes, but they are some of the most popular ones used and I wanted to demonstrate how they can be build as well. Half of them are only available through paid versions. I will be adding new images on regular basis, based on usage and impact. This looks really good. Good luck for your project! Also a quick question but when you mention Minimal being well.. Minimal? How much more minimal would it…
I think it depends on your use case, an image can be as small as default static, but if you need more, we need to add packages. Minimal images make sure we do that with least attack surface.
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#27Fewer CVEs do not necessarily mean safety.
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#28As those are built on Wolfi by Chainguard I would not use them in production. They restricted already their own images for only paid customers and also recently limited OSS entirely on Wolfi. So there is no guarantee how long the packages may be available for non paying customers.
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#29I have been curious on secure base images for the AI ecosystem, where we need to ship with cuda 11.8/12.8/13.1 for stability reasons, and in our case, a bit of the torch ecosystem and Nvidia rapids ecosystem. That ends up being... A lot. Extra fun: going all the way to FIPS..
[dead]
Re: Show HN: Minimal – Open-Source Community driven Hardened Container Images
#30are these images based on debian? seems unclear as they are all framework specific..