Tag
I built the same Go and Python app on Wolfi, Alpine, distroless and Debian slim. For Go, chainguard/static and distroless/static leave 3.1 and 3.3 MB compressed with zero CVEs. For Python, Alpine gives the smallest image (24.2 MB) if every dependency ships a musl wheel; Debian slim weighs twice as much and Trivy reports 204 findings.
Wolfi, the kernelless distribution Chainguard announced in 2022, is now the base of Chainguard OS. Guide re-tested on 16 September 2026 on arm64: glibc 2.44, how to search its 15,119 packages with apk, SBOMs and signatures, an apko-built image, the 6-month retention policy and a comparison with Alpine and Debian slim.
Chainguard Images are minimal Docker containers from the company behind Sigstore, with zero known CVEs, Cosign-signed SBOMs and daily rebuilds on top of Wolfi, its own glibc-based distribution. They pay off over official images when strict compliance, supply chain audits or sensitive production workloads are at stake.
