Wolfi

Wolfie is a minimal, rolling Linux distribution designed to reduce a system's attack surface.

Chainguard is a software supply-chain security company that provides trusted open-source artifacts for containers, language libraries, VM images, CI/CD actions, and AI agent skills. Its artifacts are rebuilt from source, include verified manifests, provenance and software bills of materials, and are designed to replace vulnerable or malicious public packages. Chainguard also offers CVE backports, hardened actions and community skills, sandbox-based package analysis for suspicious behavior, Helm charts, and an agent called Guardener. Its container service includes rapid remediation commitments, including a one-day SLA for known exploited vulnerabilities; the videos also describe a minimal rolling Linux distribution with 1-, 7-, and 14-day remediation SLAs. The company is associated with the creators of Kubernetes, Sigstore, SLSA, and Google Distroless.

Chainguard Containers are hardened container images from Chainguard, built from source and rebuilt daily. The images include verified manifests and provenance information, attached software bills of materials, and vulnerability remediation commitments; Chainguard says its catalog contains more than 3,000 images with substantially fewer CVEs than public alternatives. The images are distributed through Chainguard's registry and are intended to reduce the vulnerability and malware exposure of containerized applications.

Chainguard Actions are hardened, drop-in replacements for GitHub Actions CI/CD steps. They are designed to protect CI/CD pipelines and privileged code from supply-chain risks; Chainguard's site describes a catalog of more than 1,000 CI/CD actions as part of its trusted open-source artifact offerings.

Chainguard Libraries is a trusted catalog of language dependencies for Python, Java, JavaScript, Go, and .NET. It provides replacement repositories for public package registries such as PyPI, npm, and Maven Central; Chainguard takes upstream source, builds and scans the resulting artifacts, and serves them for use instead of relying on live access to public registries. Chainguard says its packages are detonated in a sandbox to identify suspicious behavior and are supplied as hardened artifacts intended to reduce malware and vulnerability risk in software dependencies. The service is developed and hosted by Chainguard.