{"slug": "chainguard", "name": "Chainguard", "category": "infra", "category_name": "Infrastructure and DevOps", "description": "", "recommenders": 4, "commenters": 8, "warners": 0, "score": 4.404, "rising": -1.31, "first": "2025-12-17", "latest": "2026-10-21", "why": "One alternative to cooldowns is commercial repackagers, like Chainguard.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 2, "compare": 3, "warn": 0}, "spark": [0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "One alternative to cooldowns is commercial repackagers, like Chainguard.", "kind": "", "icon": true, "domain": "chainguard.dev", "github_repo": null, "official_url": "https://www.chainguard.dev/", "pricing": "", "aliases": ["Chainguard", "Chainguard Images"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 769687744, "item_id": 48105484, "url": "https://news.ycombinator.com/item?id=48105484", "by": "chickensong", "date": "2026-05-12", "stance": "recommend", "quote": "https://www.chainguard.dev/", "excerpt": "https://www.chainguard.dev/", "context": "", "use_case": "", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 764423216, "item_id": 47776451, "url": "https://news.ycombinator.com/item?id=47776451", "by": "regularfry", "date": "2026-04-15", "stance": "recommend", "quote": "One alternative to cooldowns is commercial repackagers, like Chainguard.", "excerpt": "I don't think this is wrong, but I don't think it will be a problem in practice. One alternative to cooldowns is commercial repackagers, like Chainguard. As long as there are commercial clients who want a validated source of packages, there'll be a market for providing a security wrapper around private package repositories. It's in their interests to a) be quick to get new package versions through, and b) share any f", "context": "", "use_case": "validated package sources", "switched_from": "", "story": "Dependency cooldowns turn you into a free-rider"}, {"id": 755214593, "item_id": 47200912, "url": "https://news.ycombinator.com/item?id=47200912", "by": "boulos", "date": "2026-02-28", "stance": "recommend", "quote": "Chainguard is going to keep patching MinIO for CVEs", "excerpt": "Maybe the author isn't aware that Chainguard is going to keep patching MinIO for CVEs: https://www.chainguard.dev/unchained/secure-and-free-minio-chainguard-containers You wouldn't get the other changes in this post (e.g., restoring the admin console) but that's a bit orthogonal.", "context": "", "use_case": "", "switched_from": "", "story": "MinIO Is Dead, Long Live MinIO"}, {"id": 740851921, "item_id": 46303245, "url": "https://news.ycombinator.com/item?id=46303245", "by": "progbits", "date": "2025-12-17", "stance": "recommend", "quote": "Chainguard still has better CVE response time", "excerpt": "Bitnami is in broadcom hell, nobody should use that. Chainguard still has better CVE response time and can better guarantee you zero active exploits found by your prod scanners. (No affiliation with either, but we use chainguard at work, and used to use bitnami too before I ripped it all out)", "context": "", "use_case": "Container images", "switched_from": "Bitnami", "story": "A Safer Container Ecosystem with Docker: Free Docker Hardened Images"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["hardened container images", "validated package sources", "container images"], "compared": [{"slug": "docker-hardened-images", "name": "Docker Hardened Images", "co": 3, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 740863888, "item_id": 46303993, "url": "https://news.ycombinator.com/item?id=46303993", "by": "dlor", "date": "2025-12-17", "stance": "recommend", "quote": "I work at Chainguard. We don't guarantee zero active exploits, but we do have a contractual SLA we offer around CVE scan results", "excerpt": "Hey! I work at Chainguard. We don't guarantee zero active exploits, but we do have a contractual SLA we offer around CVE scan results (those aren't quite the same thing unfortunately). We do issue an advisory feed in a few versions that scanners integrate with. The traditional format we used (which is what most scanners supported at the time) didn't have a way to include pending information so we couldn't include it ", "context": "works at Chainguard", "use_case": "hardened container images", "switched_from": "", "story": "A Safer Container Ecosystem with Docker: Free Docker Hardened Images"}], "threads": [{"url": "https://news.ycombinator.com/item?id=50172041", "title": "Security advisory: Critical remote code execution vulnerabilities, update now", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46302337", "title": "A Safer Container Ecosystem with Docker: Free Docker Hardened Images", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48658361", "title": "Minimus container images are now free", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48100706", "title": "TanStack NPM Packages Compromised", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47773812", "title": "Dependency cooldowns turn you into a free-rider", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47200342", "title": "MinIO Is Dead, Long Live MinIO", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {"compare": 1}, "2026-02": {"compare": 1, "recommend": 1}, "2026-03": {}, "2026-04": {"recommend": 1}, "2026-05": {"recommend": 1}, "2026-06": {"compare": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"neutral": 2}}, "quotes": [{"id": 802853584, "item_id": 50178349, "url": "https://news.ycombinator.com/item?id=50178349", "by": "joshuat", "date": "2026-10-21", "stance": "neutral", "quote": "fwiw it looks like the patches were made available early on chainguard", "excerpt": "fwiw it looks like the patches were made available early on chainguard https://images.chainguard.dev/directory/image/php/versions", "context": "", "use_case": "", "switched_from": "", "story": "Security advisory: Critical remote code execution vulnerabilities, update now"}, {"id": 802826640, "item_id": 50176665, "url": "https://news.ycombinator.com/item?id=50176665", "by": "ftfyyyyyy", "date": "2026-10-21", "stance": "neutral", "quote": "looks like patched builds for 8.5-8.2 are available here", "excerpt": "https://images.chainguard.dev/directory/image/php looks like patched builds for 8.5-8.2 are available here", "context": "", "use_case": "", "switched_from": "", "story": "Security advisory: Critical remote code execution vulnerabilities, update now"}, {"id": 778540386, "item_id": 48658774, "url": "https://news.ycombinator.com/item?id=48658774", "by": "hobofan", "date": "2026-06-24", "stance": "compare", "quote": "DHI (Docker Hardened Images) or Chainguard Images, both of which also have a set of free hardened images", "excerpt": "Asking the very obvious question (as it's not apparent from the website): Why would I use this over DHI (Docker Hardened Images) or Chainguard Images, both of which also have a set of free hardened images?", "context": "", "use_case": "hardened container images", "switched_from": "", "story": "Minimus container images are now free"}, {"id": 769687744, "item_id": 48105484, "url": "https://news.ycombinator.com/item?id=48105484", "by": "chickensong", "date": "2026-05-12", "stance": "recommend", "quote": "https://www.chainguard.dev/", "excerpt": "https://www.chainguard.dev/", "context": "", "use_case": "", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 764423216, "item_id": 47776451, "url": "https://news.ycombinator.com/item?id=47776451", "by": "regularfry", "date": "2026-04-15", "stance": "recommend", "quote": "One alternative to cooldowns is commercial repackagers, like Chainguard.", "excerpt": "I don't think this is wrong, but I don't think it will be a problem in practice. One alternative to cooldowns is commercial repackagers, like Chainguard. As long as there are commercial clients who want a validated source of packages, there'll be a market for providing a security wrapper around private package repositories. It's in their interests to a) be quick to get new package versions through, and b) share any f", "context": "", "use_case": "validated package sources", "switched_from": "", "story": "Dependency cooldowns turn you into a free-rider"}, {"id": 755214593, "item_id": 47200912, "url": "https://news.ycombinator.com/item?id=47200912", "by": "boulos", "date": "2026-02-28", "stance": "recommend", "quote": "Chainguard is going to keep patching MinIO for CVEs", "excerpt": "Maybe the author isn't aware that Chainguard is going to keep patching MinIO for CVEs: https://www.chainguard.dev/unchained/secure-and-free-minio-chainguard-containers You wouldn't get the other changes in this post (e.g., restoring the admin console) but that's a bit orthogonal.", "context": "", "use_case": "", "switched_from": "", "story": "MinIO Is Dead, Long Live MinIO"}, {"id": 753978416, "item_id": 47123651, "url": "https://news.ycombinator.com/item?id=47123651", "by": "pploug", "date": "2026-02-23", "stance": "compare", "quote": "precision versus using 100s of thousands on chainguard", "excerpt": "Outlining this as precision versus using 100s of thousands on chainguard, seems like 2 extremes pitted against eachother, when hardened images is largely free now: https://hub.docker.com/hardened-images/catalog", "context": "", "use_case": "", "switched_from": "", "story": "A Bug Is a Bug, but a Patch Is a Policy: The Case for Bootable Containers"}, {"id": 749463392, "item_id": 46841462, "url": "https://news.ycombinator.com/item?id=46841462", "by": "hobofan", "date": "2026-01-31", "stance": "compare", "quote": "Isn't this mostly the same thing that Chainguard already provides themselves?", "excerpt": "Isn't this mostly the same thing that Chainguard already provides themselves? E.g. the \"Free\" images on their page [0] have a big overlap with the toolchains from your repo. [0]: https://images.chainguard.dev", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Minimal \u2013 Open-Source Community driven Hardened Container Images"}, {"id": 740851921, "item_id": 46303245, "url": "https://news.ycombinator.com/item?id=46303245", "by": "progbits", "date": "2025-12-17", "stance": "recommend", "quote": "Chainguard still has better CVE response time", "excerpt": "Bitnami is in broadcom hell, nobody should use that. Chainguard still has better CVE response time and can better guarantee you zero active exploits found by your prod scanners. (No affiliation with either, but we use chainguard at work, and used to use bitnami too before I ripped it all out)", "context": "", "use_case": "Container images", "switched_from": "Bitnami", "story": "A Safer Container Ecosystem with Docker: Free Docker Hardened Images"}]}