https://taihen.org/tags/supply-chain/Recent content in Supply-Chain on taihen.org / 418 ... engineering in progressHugoen-usTue, 14 Jul 2026 15:30:00 +0200https://taihen.org/posts/distroless-was-the-easy-part/Tue, 14 Jul 2026 15:30:00 +0200https://taihen.org/posts/distroless-was-the-easy-part/<p>Last year I wrote about <a href="https://taihen.org/posts/distroless/">distroless containers</a> and finished with a small brag: I build my own minimal base image with <a href="https://github.com/chainguard-dev/apko">apko</a> and <a href="https://github.com/wolfi-dev/os">Wolfi</a>, look how tiny it is, look how few packages it has.</p> <p>This year I held that image against the standards that serious hardened-image vendors compete on. <strong>It failed.</strong></p> <p>Not because of what was inside the image. The contents were fine. Six packages, no shell, non-root user, signed with <a href="https://github.com/sigstore/cosign">Cosign</a>. It failed because of everything around the image and that is exactly where the state of the art has moved.</p>