Chainguard Containers To the Rescue!

Chainguard Containers are curated, distroless container images designed for a secure software supply chain: minimal attack surface, low-to-zero vulnerabilities, verifiable signatures, high-quality SBOMs, and automated nightly rebuilds. In this course, you’ll learn how to start using Chainguard Containers in your everyday container workflows and how to migrate from traditional images with far higher CVE counts.

You’ll practice pulling and running images from cgr.dev, choosing tags vs. digests for stability and reproducibility, and selecting the right image variant for your needs (runtime vs. dev/debug). You’ll also learn how the Tag History API helps you pin specific builds and safely manage updates. Finally, you’ll cover practical debugging approaches for distroless images, including dev variants and Kubernetes ephemeral debug containers.

Learning objectives

By the end of this course, you will be able to:

• Explain what Chainguard Containers are and how they reduce vulnerabilities through minimal design and frequent rebuilds;
• Identify core supply chain security features included with Chainguard Containers, like SBOMs, signatures, reproducible builds, and nightly builds;
• Pull and run Chainguard Containers from cgr.dev, including selecting appropriate tags and platforms;
• Use image digests to pin builds for reproducibility and stability;
• Use the Tag History API to retrieve historical digests for a given image tag and apply them in Dockerfiles;
• Choose between distroless runtime images, -dev variants, and wolfi-base based on build/debug needs;
• Apply practical debugging strategies for distroless containers, including Kubernetes ephemeral debug containers.