this space is too crowded now. everyone is copying whatever Chainguard is doing
- Chainguard Images
- Chainguard Libraries
- Chainguard VM
...
Minimus container images are now free
41–50 of 80 posts
Re: Minimus container images are now free
#42Supply chain attack waiting to happen
Re: Minimus container images are now free
#43John here (CTO and Co-Founder)… we’d be happy to answer any questions anyone has!
Is there a single upstream that all images are based on? Debian? Arch? Alpine?
Curious how this plays into customizing images with creator, are you guys responsible for all the packaging?
Would my keester be on the line if say an upstream package got hit with an attack but I use it through creator?
Re: Minimus container images are now free
#44Earlier quoted context omitted.
1. These are all >1200 of our images, including FIPS, and all versions… others gate many of their images 2. These are all built continuously from upstream source on a distroless base… this makes a significant difference in attack surface and CVE count re DHI images and you can easily check our word with a few scans 3. These are truly free… no auth wall, no signup, no trial, no limit on numbers of images or pulls or a…
>are all built continuously from upstream source 2. Isn't there a slight risk of upstream attacks being amplified by this? With the recent number of software compromises providing a way for people to use images X days old may be useful. 3. This ties into 2, if someone downloads and uses an image that is later found to be compromised they mostly have no way of being notified that happened. Not a huge issue, but is som…
Pausing software updates by X days old is a hack at best for specific distribution platforms (npm), not a general security recommendation.
Re: Minimus container images are now free
#45Supply chain attack waiting to happen
Maybe it's their business model? Sell to bunch of people and hook them in, then "get hacked", whoops sorry.
Edit: honestly I'm flagging this post. This really looks like fishing for customers to make them vulnerable in future.
Re: Minimus container images are now free
#46Completely blocking the image information page to mobile user agents is completely unnecessary. I'd much rather look at your non optimized page than be told to come back on desktop. Moreover, even after switching to desktop mode on my phone, there's nothing I see that precludes you from employing a little bit of CSS to make those pages render more nicely on mobile screens.
Seriously. I get the sibling comment seemingly from someone involved talking about eng resources being tight, but blocking it instead of just showing a desktop page feels absurd.
Takes more eng resources to block mobile than not
Re: Minimus container images are now free
#47this space is too crowded now. everyone is copying whatever Chainguard is doing - Chainguard Images - Chainguard Libraries - Chainguard VM ...
Because Chainguard cost an arm and a leg.
Re: Minimus container images are now free
#48Supply chain attack waiting to happen
Maybe it's their business model? Sell to bunch of people and hook them in, then "get hacked", whoops sorry. Edit: honestly I'm flagging this post. This really looks like fishing for customers to make them vulnerable in future.
What are you even talking about?
Re: Minimus container images are now free
#49Is their ingress-nginx-controller image similar to that of Chainguard: a drop-in replacement with the CVEs fixed?
yes it is
Re: Minimus container images are now free
#50Earlier quoted context omitted.
1. These are all >1200 of our images, including FIPS, and all versions… others gate many of their images 2. These are all built continuously from upstream source on a distroless base… this makes a significant difference in attack surface and CVE count re DHI images and you can easily check our word with a few scans 3. These are truly free… no auth wall, no signup, no trial, no limit on numbers of images or pulls or a…
>are all built continuously from upstream source 2. Isn't there a slight risk of upstream attacks being amplified by this? With the recent number of software compromises providing a way for people to use images X days old may be useful. 3. This ties into 2, if someone downloads and uses an image that is later found to be compromised they mostly have no way of being notified that happened. Not a huge issue, but is som…
> 2. Isn't there a slight risk of upstream attacks being amplified by this?
I think the argument would be that consuming Minimus' containers would have a less severe amplification (or even reduction), as all upstream attacks that rely on a combination of third-party vulnerabilities would be rendered infeasible (since they reduce the amount of third-party dependencies in an image).
> 3. This ties into 2, if someone downloads and uses an image that is later found to be compromised they mostly have no way of being notified that happened.
For this you need a consumption-aware scanner anyways (e.g. that lists images running in your Kubernetes). Anything else will be too spammy, as you can't notify for everything for you have at some point in time have used as a base image.