What the hell is an OS without a kernel?
Is this less an OS and more like a toolchain to build container images?
Wolfi: A community Linux OS designed for the container and cloud-native era
31–40 of 89 posts
Re: Wolfi: A community Linux OS designed for the container and cloud-native era
#32We use Alpine Linux in all our docker builds for AWS ECS / Fargate. I noticed the FAQ says this: > Wolfi is a Linux undistro designed from the ground up to support newer computing paradigms such as containers. Although Wolfi has a few similar design principles as Alpine (such as using apk), it is a different distribution that is focused on supply chain security. Unlike Alpine, Wolfi does not currently build its own L…
In this case, supply chain security mostly means compliance. Alpine and other distros already do a great job at most aspects of supply chain security, but we make package/image signatures and SBOMs very easy to get in Wolfi. We're also more flexible on packaging extra software in Wolfi than other distros are, which has an effect on your overall supply chain security posture. We're aiming to package the entire Cloud N…
I’ve worked in a few industries that were crazy about compliance. Do you have any certifications for different compliances? Ie FedRamp, IL4/5/6, HIIPA, etc.
I don’t think any other container images are strictly compliant with these standards - they’re not certified, but the technology stack (ECS, EKS, etc) is certified. Either way, if you can get this certified with different compliance platforms that would be a big selling point for B2B customers.
Re: Wolfi: A community Linux OS designed for the container and cloud-native era
#33Earlier quoted context omitted.
In this case, supply chain security mostly means compliance. Alpine and other distros already do a great job at most aspects of supply chain security, but we make package/image signatures and SBOMs very easy to get in Wolfi. We're also more flexible on packaging extra software in Wolfi than other distros are, which has an effect on your overall supply chain security posture. We're aiming to package the entire Cloud N…
I’ve worked in a few industries that were crazy about compliance. Do you have any certifications for different compliances? Ie FedRamp, IL4/5/6, HIIPA, etc. I don’t think any other container images are strictly compliant with these standards - they’re not certified, but the technology stack (ECS, EKS, etc) is certified. Either way, if you can get this certified with different compliance platforms that would be a big…
We're working on FIPS builds and will self-attest to the NIST SSDF stuff later this fall, but there aren't too many other requirements that directly apply to our images.
The images are very useful for other organizations working on FedRAMP or HIPAA though, even though we don't need to have those ourselves. We wrote a bit more about that here: https://www.chainguard.dev/unchained/fortify-comply-and-conq...
Re: Wolfi: A community Linux OS designed for the container and cloud-native era
#34We use Alpine Linux in all our docker builds for AWS ECS / Fargate. I noticed the FAQ says this: > Wolfi is a Linux undistro designed from the ground up to support newer computing paradigms such as containers. Although Wolfi has a few similar design principles as Alpine (such as using apk), it is a different distribution that is focused on supply chain security. Unlike Alpine, Wolfi does not currently build its own L…
In this case, supply chain security mostly means compliance. Alpine and other distros already do a great job at most aspects of supply chain security, but we make package/image signatures and SBOMs very easy to get in Wolfi. We're also more flexible on packaging extra software in Wolfi than other distros are, which has an effect on your overall supply chain security posture. We're aiming to package the entire Cloud N…
Do you provide an OVAL feed?
Alpine is out of the picture for us because the guy that works on their security tracker just doesn't care, and responds half a year after filing an issue. The tracker itself is broken for over a year and the response was to basically rebuild our own package index and host our own security tracker.
So I would not say that Alpine has security as a high priority, even though in theory there are the secfixesdb.
Redhat Enterprise, Debian and Ubuntu are used because they provide an OVAL feed that are easily integrated with zero development overhead. So if compliance is your focus, I'd heavily recommend generating an OVAL feed when you're regenerating the secfixes json files.
Source: Am building a cross-linux-distro vulnerability database and I am scraping _all_ linux security trackers. [1]
Re: Wolfi: A community Linux OS designed for the container and cloud-native era
#35Distroless or not, maintainers are required… but for me running docker pull debian still does the job. Whats wrong with current distros vuln assesment and security reporting to have another one?
Debian does a great job! But here's one example where their packaging system makes container workloads hard. Debian, like many other distros has a strict "one version of every package" rule, meaning that Debian only ships one version of common things like programming languages or webservers. If you "apt-get install nodejs", you can only have Node.js v18, in the very very recently released Debian bookworm. If your dev…
If I need node.js 20 I will just use the node:20-bookworm image.
Re: Wolfi: A community Linux OS designed for the container and cloud-native era
#36While I do appreciate the great work than Dan and team do, I feel like posting this headline, at this time, is click-baiting and playing off the recent Red Hat shake up to try and grab attention.
Is this the first and only submission about Wolfi? It may just enjoy traction because of the recent news. Also, posting and upvoting timely and relevant links is something that makes HN valuable, among other things.
What’s the new news? The last major RedHat drama I’m aware of was the CentOS shakeup.
Re: Wolfi: A community Linux OS designed for the container and cloud-native era
#37Earlier quoted context omitted.
In this case, supply chain security mostly means compliance. Alpine and other distros already do a great job at most aspects of supply chain security, but we make package/image signatures and SBOMs very easy to get in Wolfi. We're also more flexible on packaging extra software in Wolfi than other distros are, which has an effect on your overall supply chain security posture. We're aiming to package the entire Cloud N…
Do you provide an OVAL feed? Alpine is out of the picture for us because the guy that works on their security tracker just doesn't care, and responds half a year after filing an issue. The tracker itself is broken for over a year and the response was to basically rebuild our own package index and host our own security tracker. So I would not say that Alpine has security as a high priority, even though in theory there…
Thanks for the pointer! We update the JSON feed now but should be able to generate an OVAL feed too.
Re: Wolfi: A community Linux OS designed for the container and cloud-native era
#38Earlier quoted context omitted.
That's cool, but aren't containers considered to be a workaround for exactly that problem?
Yep, but workarounds come with a cost. We're trying to package basically everything, so you don't need to pick between "up to date software" and "software from a trusted distro". It's going to be hard to scale, but we're going to at least try! We have a lot of ideas on how to make this work that I'm excited to try out.
So you want to provide all the up to date software, but as battle tested as the software included in the debian repos, with a few people?
Re: Wolfi: A community Linux OS designed for the container and cloud-native era
#39What the hell is an OS without a kernel? Is this less an OS and more like a toolchain to build container images?
99% of Wolfi is the package repository. We've compiled all the software to run an OS from source against glibc and made it available as APKs (apart from the kernel). The major use case for this is composing container images using tools like apko.
When you run Linux containers, you're using the kernel from the host, but everything else is provided in the container i.e. file system, utilities etc. So you can effectively run Debian or Alpine on top of a Arch kernel by just doing "docker run debian" etc. And now you can also do "docker run cgr.dev/chainguard/wolfi-base".
Re: Wolfi: A community Linux OS designed for the container and cloud-native era
#40Earlier quoted context omitted.
Is this the first and only submission about Wolfi? It may just enjoy traction because of the recent news. Also, posting and upvoting timely and relevant links is something that makes HN valuable, among other things.
What’s the new news? The last major RedHat drama I’m aware of was the CentOS shakeup.
Ah, they changed RHEL Source visibility from Public to subscribers only to make it harder for Rocky Linux, et al to provide strong compatibility. Lame.