Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building the World: The Story Behind Wolfi

Building the World: The Story Behind Wolfi

As the container ecosystem matures, there is an increased need for new standards and runtime environments that take into consideration security and provenance concerns, driving the next generation of tools and recommended practices to build container images.

In this talk, you'll learn everything about Wolfi, a Linux "undistro" built for containers. We'll see why it was created and how it is maintained, using the Wolfi PHP package to demonstrate our open source apk build system.

Erika Heidi

October 13, 2023

More Decks by Erika Heidi

Other Decks in Programming


  1. Hi, I'm Erika! • Developer Experience Engineer at Chainguard ◦

    Writing docs, tutorials, presentations, demos… • Open Source enthusiast ◦ PHP Developer focused on CLI applications ◦ Author of Minicli, Librarian, autodocs… • Too many hobbies
  2. • Small Linux Distro for Containers • "Undistro" because it

    doesn't have stuff that normally goes into a Linux distribution • Based on apk (the Alpine package manager) • Fast updates What is Wolfi?
  3. • Has a design that facilitates reproducible builds • System

    state is not changed if the apk resolver can't "fix the world" Why APK?
  4. melange • Declarative apk builder tool • Build pipelines are

    defined in YAML files • Multi-architecture by default • Platform-agnostic builds via Docker + melange image The Tools apko • Declarative OCI image builder tool based on apk • Generates flat images w/ a single layer • Images are defined in YAML files • Builds are fully reproducible • Automatically generates SBOMs for every image • Platform-agnostic builds via Docker + apko image
  5. Why apko: building distroless images • Minimalist container images with

    only what's absolutely necessary to build or execute your application • Popular base images are full of software that only makes sense on bare-metal • No need for package managers or interactive shells on production images • Less dependencies = smaller attack surface, less CVEs
  6. Building Wolfi-based PHP Images • Use cgr.dev/chainguard/php:latest-dev with a Dockerfile

    and install missing dependencies • Use cgr.dev/chainguard/wolfi-base:latest with a Dockerfile and install all dependencies • Use apko for composing a flat, distroless image using Wolfi packages 3 ways to use Wolfi for your PHP runtimes
  7. Happy birthday Wolfi! From zero to 1600+ package configs in

    one year, which builds into 18k+ packages available via Wolfi's repo In the month of September, we celebrated Wolfi's first birthday 🎉 18k+ packages With more than 60 contributors from around the world and a strong team of in-house maintainers, for a fast-paced update cadence and new packages added daily 4k+ PRs merged Is the average time it takes for a package to be updated or patched to their latest release and made available upstream Less than 24h
  8. Learn more and get involved • Wolfi documentation at Chainguard

    Academy • Wolfi repository on GitHub • Building a Wolfi Package - tutorial • Issues tagged for Hacktoberfest • Wolfi Community Call Calendar • Wolfi on X/Twitter