Chainguard Academy

Product Docs

    • Overview
      • Build Criteria
      • Shared Responsibility Model
      • Going Distroless
      • How We Test
      • Container Variants
      • Product Release Lifecycle
      • Container Categories
        • Selecting a Container
        • glibc vs. musl
      • Video: Low-to-No CVEs
      • Video: Beyond Zero
        • Overview
        • Manage with chainctl
        • Manage with Chainguard's API
      • STIGs
      • Unique Tags
      • Tag History API
        • FIPS FAQs
        • FIPS Containers
      • CVE Visualizations
      • Custom Certificates
      • Private APK Repositories
      • Using Chainguard Containers
      • Retrieve SBOM
      • Verifying Containers
      • Containers Directory
      • Dev Containers
      • Using the Static Base Container
      • Digests
      • Reproducible Dockerfiles
      • Software Versions
      • Minimal Runtime Containers
      • C/C++
      • Cilium
      • Go
      • Istio
      • Laravel
      • MariaDB
      • NeMo
      • nginx
      • Node
      • PHP
      • PostgreSQL
      • Python
      • PyTorch
      • Ruby
      • WordPress
      • JRE + Minecraft
      • Minimize CVE Risk
      • FedRAMP Considerations
      • Video: Reproducibility
        • Container Update Considerations
        • EOL Vulnerabilities
        • Update Strategies and Tools
        • Using Renovate
        • Up-to-date Containers with Digestabot
        • Using Advisories
        • Advisory Life Cycle
        • Managing Advisories
        • False Positives and Negatives
        • Grype
        • Trivy
      • Debugging
      • Video: Debugging Distroless Containers
      • Video: Debugging with Kubectl and CDebug
      • bash
      • busybox
      • curl
      • deno
      • dex
      • dotnet-runtime
      • dotnet-sdk
      • etcd
      • git
      • go
      • gradle
      • haproxy
      • jenkins
      • kube-state-metrics
      • mariadb
      • maven
      • memcached
      • minio
      • minio-client
      • nats
      • nginx
      • node
      • opensearch
      • php
      • postgres
      • python
      • r-base
      • rabbitmq
      • redis
      • ruby
      • rust
      • telegraf
      • traefik
      • wait-for-it
      • wolfi-base
      • zookeeper
    • FAQs
    • Libraries Overview
    • Access
    • FAQ
      • Java Overview
      • Global Configuration
      • Build Configuration
      • Management
    • Registry Overview
    • Authenticate
      • Google Artifact Registry
        • Registry Pull-Through
        • Mirroring Packages
      • Nexus
      • Cloudsmith
    • Migration Overview
    • Porting a Sample Application
    • Migrating Dockerfiles
    • Migration Checklist
    • Dockerfile Converter
      • Alpine
      • Debian
      • Ubuntu
      • Red Hat
      • PHP
      • Node
      • Video: Node.js
      • Python
      • Video: Go
      • Video: Java
    • Network Requirements
    • Terraform Provider
      • IAM Overview
      • Manage IAM Organizations
      • Verified Organizations
        • Roles and Role-bindings Overview
        • GitHub Team Role-binding
      • Assumable IDs Overview
        • GitHub Actions
        • GitLab CI/CD
        • AWS Lambda
        • AWS EC2
        • Buildkite
        • Bitbucket
        • Jenkins
        • Keycloak
      • Authenticate with Custom IDPs
        • Okta
        • Ping Identity
        • Keycloak
        • Microsoft Entra ID
      • Subscribe to Events
      • Mirror Containers to Artifact Registry
      • Chainguard Events
    • OpenAPI Specification
    • Install chainctl
    • Get Started with chainctl
    • Manage Your chainctl Configuration
    • Find and Update Your chainctl Release Version
    • Compare Images with chainctl
    • Create, View, and Delete chainctl Events
    • chainctl iam
    • Manage Chainguard Container Images with chainctl
    • chainctl packages
    • chainctl
    • chainctl auth
    • chainctl auth configure-docker
    • chainctl auth login
    • chainctl auth logout
    • chainctl auth pull-token
    • chainctl auth status
    • chainctl auth token
    • chainctl config
    • chainctl config edit
    • chainctl config reset
    • chainctl config save
    • chainctl config set
    • chainctl config unset
    • chainctl config validate
    • chainctl config view
    • chainctl events
    • chainctl events subscriptions
    • chainctl events subscriptions create
    • chainctl events subscriptions delete
    • chainctl events subscriptions list
    • chainctl iam
    • chainctl iam account-associations
    • chainctl iam account-associations check
    • chainctl iam account-associations check aws
    • chainctl iam account-associations check gcp
    • chainctl iam account-associations describe
    • chainctl iam account-associations set
    • chainctl iam account-associations set aws
    • chainctl iam account-associations set gcp
    • chainctl iam account-associations unset
    • chainctl iam account-associations unset aws
    • chainctl iam account-associations unset gcp
    • chainctl iam folders
    • chainctl iam folders delete
    • chainctl iam folders describe
    • chainctl iam folders list
    • chainctl iam folders update
    • chainctl iam identities
    • chainctl iam identities create
    • chainctl iam identities create github
    • chainctl iam identities create gitlab
    • chainctl iam identities delete
    • chainctl iam identities describe
    • chainctl iam identities list
    • chainctl iam identities update
    • chainctl iam identity-providers
    • chainctl iam identity-providers create
    • chainctl iam identity-providers delete
    • chainctl iam identity-providers list
    • chainctl iam identity-providers update
    • chainctl iam invites
    • chainctl iam invites create
    • chainctl iam invites delete
    • chainctl iam invites list
    • chainctl iam organizations
    • chainctl iam organizations delete
    • chainctl iam organizations describe
    • chainctl iam organizations list
    • chainctl iam role-bindings
    • chainctl iam role-bindings create
    • chainctl iam role-bindings delete
    • chainctl iam role-bindings list
    • chainctl iam role-bindings update
    • chainctl iam roles
    • chainctl iam roles capabilities
    • chainctl iam roles capabilities list
    • chainctl iam roles create
    • chainctl iam roles delete
    • chainctl iam roles list
    • chainctl iam roles update
    • chainctl images
    • chainctl images diff
    • chainctl images history
    • chainctl images list
    • chainctl images repos
    • chainctl images repos build
    • chainctl images repos build apply
    • chainctl images repos build edit
    • chainctl images repos build list
    • chainctl images repos build logs
    • chainctl images repos list
    • chainctl packages
    • chainctl packages versions
    • chainctl packages versions list
    • chainctl update
    • chainctl version

Open Source

      • apko Overview
      • apko FAQs
      • Getting Started with apko
      • Troubleshooting apko Builds
      • Bazel Rules
      • melange Overview
      • Getting Started with melange
      • Troubleshooting Builds
      • melange FAQs
    • What is SLSA?
    • What is an SBOM?
    • OpenVEX and vexctl
    • What Makes a Good SBOM?
    • What is OpenVex?
    • SBOMs and Attestations
    • Wolfi Overview
    • Building a Wolfi Package
    • Wolfi FAQs
    • Why apk
    • Hello Wolfi Workshop
    • Wolfi Images with Dockerfiles
    • Package Version Selection
    • What is the OCI?
    • What are OCI Artifacts?
    • Keyless Signing
      • Introduction
      • Install
      • Sign a Container
      • Sign Blobs and Files
      • Sign an SBOM
      • Verify File Signatures
      • Cosign: The Manual Way
      • Install
        • Enforce SBOM attestation with Policy Controller
        • Disallowing Non-Default Capabilities
        • Disallowing Privileged Pods
        • Disallowing Run as Root User
        • Maximum Container Image Age
        • Disallowing Unsafe sysctls
        • Verify Signed Chainguard Containers
        • Critical CVEs
        • Rego Policies
        • Example Policies
      • Introduction
      • Generate Fulcio Certificate
      • Inspect and Verify Certificates
      • Introduction
      • Install
      • Query Rekor
      • Sign and Upload Metadata
      • Set Up Local Instance

Education

  • Containers
  • Selecting a Base Image
  • Software Supply Chain Security
  • Chainguard Glossary
  • Trademark Use Policy
      • Introduction to the PCI Data Security Standard (DSS) 4.0
      • Overview of PCI DSS 4.0 Practices/Requirements
      • Simplify Your Path to PCI DSS 4.0 Compliance with Chainguard
      • Introduction to the Cybersecurity Maturity Model Certification (CMMC) 2.0
      • CMMC 2.0 Maturity Levels
      • Overview of CMMC 2.0 Practices/Control Groups
      • Simplify Your Path to CMMC 2.0 Compliance with Chainguard
    • CIS Benchmarks
    • #1 - Fighting Vulnerabilities
    • What Are Software Vulnerabilities and CVEs?
    • Why Care About Software Vulnerabilities?
    • Infamous Software Vulnerabilities
    • Software Vulnerability Remediation
    • Self-Attestation Form
    • Table of NIST SSDF
    • Minimum Attestation References
Go to Chainguard.dev
Send feedback Contact

John Speed Meyers

Security Data Scientist at Chainguard

Selecting a Base Container Image

What is software supply chain security

What Makes a Good SBOM?

Products
Chainguard Containers Chainguard Libraries Chainguard VMs Images Directory
Why Chainguard
Container Image Security Vulnerability Remediation Compliance and Risk Mitigation Software Supply Chain Security AI/ML Security FedRAMP PCI
Customers
Customer Stories Chainguard Love
Company
About Us Pricing Contact Us Open Source Careers Newsroom Legal
Resources
Unchained Blog Events Trust Center Documentation
Follow Chainguard on GitHub Follow Chainguard on X Follow Chainguard on YouTube Follow Chainguard on LinkedIn © 2025 Chainguard. All Rights Reserved.