Yo Motherboard

What's the Real Benefit of Using Chainguard Packages?

March 28, 2026 4 answers
Asked by CuriousCoder92
I'm currently using Chainguard images as the base for some workloads at my company, and I've recently started looking into their Chainguard Packages offering. I attended KubeCon EU last week where they were promoting this heavily. I'm trying to wrap my head around the actual value it brings and would love to hear from others who've looked into it. From what I've gathered, Chainguard takes upstream packages, builds them from source in a SLSA 2-compliant pipeline, and provides verifiable artifacts. This is supposed to help guard against supply chain attacks, like the recent issue with LiteLLM, especially if you're not consistently version pinning and building. I have a few lingering questions that I'm hoping to clarify: 1. Package Coverage: Can they really cover all the packages I might need? It seems like I'd end up with a mix from Chainguard and other sources like PyPI. If that's the case, have I actually simplified my trust model or just added more complexity? 2. Alternatives like PEP740: For Python, PEP740 seems to tackle similar issues. While it's not universally adopted yet, many major packages I use support it. What extra benefits do Chainguard Packages provide in comparison? How does this apply to environments like NPM or Maven? 3. Speeding Up CVE Patching: If they're building from the same upstream sources, how do they patch vulnerabilities faster than the upstream projects? If they're patching independently, do those fixes get sent back to the original projects, or am I just running their forked versions? I realize this is a new offering, but I keep finding marketing fluff instead of solid technical evaluations. Has anyone taken a deep dive into this?
Chainguard CVE patching KubeCon Programming Python packages software vulnerabilities supply chain security

Answers

SecurityScout101
Do you have a dev team that manages CVEs? That’s a big sell for a lot of CISOs—being able to outsource this process to someone else and hold them accountable makes a difference. The value in this aspect is huge since managing vulnerabilities can be a massive headache.
Reply to this answer
PackageGuru
They really showcased their value recently with the LiteLLM incident. If you'd been using Chainguard for Python, their system caught the unsigned versions of the compromised releases and blocked them. Still, you have to consider that they don't cover everything on PyPI—their focus is more on the popular packages, so full coverage isn't guaranteed.
Reply to this answer
TechSavvySteve
You’re right to be skeptical about the marketing! A lot of the value really hinges on whether you fully commit to their ecosystem. If you’re mixing sources like PyPI and npm, you’re not fully benefiting from a 'single trust model'—you just complicate things. As for the CVE claims, it’s primarily about getting faster builds from upstream rather than some magical fix, so it’s more about pipeline efficiency than additional security work. Ultimately, whether it's worth it comes down to your specific supply chain requirements.
Reply to this answer
CodeCrusader
Regarding your third question, they do work on patching CVEs before upstream releases. They’ve developed tools like omnibump (check it out [here](https://github.com/chainguard-dev/omnibump)) and you can even find many base packages directly on GitHub. Just keep in mind, not all CVEs are critical; some are just about compliance, so keeping track of those is important too.
Reply to this answer

Add your answer

Answers are reviewed before publication.

Related Discussions