A podcast conversation between Charles Humble and Adrian Mouat (DevRel at Chainguard) covering the current state of container security. Topics include why base images accumulate CVEs, how vulnerability scanners work and their signal-to-noise problem, the origins of Google's distroless project and how Chainguard extended it with Wolfi (a custom Linux distribution built from source), the role and current limitations of SBOMs and attestations, and practical security recommendations such as image immutability, signing with Sigstore, running non-root, minimizing image size to reduce attack surface, and using short-lived credentials. The discussion also covers real-world supply chain attacks including the Shyalad npm worm and the XZ Utils backdoor, and how building from source rather than consuming tarballs or published packages mitigates certain supply chain risks.
Sort: