Chainguard Images
Ranked 3 of 5 container base images by recommenders
Recommended for minimal, continually patched container images with low CVE counts and fast vulnerability response. Critics say it broke a coordinated disclosure embargo to publish fixes early.
Recommended for minimal, continually patched container images with low CVE counts and fast vulnerability response. Critics say it broke a coordinated disclosure embargo to publish fixes early.
34 people gave an opinion
- recommend it
- 9
- criticize it
- 25
- approval share
- 26%
Recommended in 4 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 9 people recommend itNeeds 10 or more, not met.
- 0.3 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 4 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Low CVE counts and fast response
“Chainguard still has better CVE response time and can better guarantee you zero active exploits found by your prod scanners.”
Comment from 17 Dec 2025 in “A Safer Container Ecosystem with Docker: Free Docker Hardened Images” “Chainguard offered images that report 0 CVEs and would basically remove this barrier.”
Comment from 17 Dec 2025 in “A Safer Container Ecosystem with Docker: Free Docker Hardened Images” Minimal, continually patched images
“I’ve become super sold on the benefits of minimal and continually patched images”
Comment from 24 Jun 2026 in “Minimus container images are now free” “Chainguard based images, packages and libraries are first line of defense.”
Comment from 1 Jun 2026 in “NPM packages from RedHat have been compromised”
What people warn about
Each mark is one comment
Published fixes before embargo ended
“They didn’t get to unilaterally decide that the embargo was inconvenient and publish early.”
Comment from 21 Oct 2026 in “Today's PHP security release, and how we're strengthening security” “Chainguard unilaterally broke the embargo and published built images containing the fix.”
Comment from 21 Oct 2026 in “Today's PHP security release, and how we're strengthening security” “Chainguard unilaterally broke the embargo and published built images containing the fix”
Comment from 21 Oct 2026 in “Today's PHP security release, and how we're strengthening security” - Comment from 22 Oct 2026 in “There isn't an easy exploit for this PHP vulnerability”
Not fully source-bootstrapped or easy to follow
“while the are open source they are less straightforward to follow”
Comment from 31 Jan 2026 in “Show HN: Minimal – Open-Source Community driven Hardened Container Images” “chainguard is not full-source bootstrapped”
Comment from 1 Feb 2026 in “Show HN: Minimal – Open-Source Community driven Hardened Container Images” Control over builds and exploit feed
“Chainguard effectively held everyone hostage, and forced everyone hosting container images and wanting to be online, to trust their builds”
Comment from 21 Oct 2026 in “Today's PHP security release, and how we're strengthening security” “if I was maintaining PHP or another critical software, I’d think twice about letting Chainguard have inside information”
Comment from 21 Oct 2026 in “Today's PHP security release, and how we're strengthening security” “Chainguard can only guarantee zero active exploits because they control their own exploit feed”
Comment from 17 Dec 2025 in “A Safer Container Ecosystem with Docker: Free Docker Hardened Images” Commercial gain put before disclosure
“It was a selfish, PR exercise. He could have done it quietly.”
Comment from 23 Oct 2026 in “Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry” “Chainguard will lie and cheat to put themselves first.”
Comment from 23 Oct 2026 in “Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry” “Instead they sought short term commercial advantage.”
Comment from 22 Oct 2026 in “Today's PHP security release, and how we're strengthening security”
Other container base images people recommend
The four most recommended other container base images, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| StageX | 12 | 5 | 71% | 10 | — | Approved |
| Docker Hardened Images | 11 | 14 | 44% | 4 | — | — |
| Chainguard ImagesThis page | 9 | 25 | 26% | 4 | — | — |
| Minimus container images | 6 | 10 | 38% | 3 | — | — |
| Distroless container images | 5 | 0 | 100% | 3 | — | — |
What people said
31 of the 35 comments that mention it, newest first. Each links to the original comment.
“Chainguard's and Calif's incompetence and irresponsibility”
“Chainguard will lie and cheat to put themselves first.”
“I hope the broader ecosystem responds by putting their customers over Chainguard.”
“It was a selfish, PR exercise. He could have done it quietly.”
“Instead they sought short term commercial advantage.”
“Chainguard did release their patches before the agreed upon time”
“Perhaps Chainguard will be the last to receive the next bug report.”
“It's maybe not professional to release an omg panic video, but not even remotely the same thing as what chainguard did.”
“if I was maintaining PHP or another critical software, I’d think twice about letting Chainguard have inside information”
“Chainguard effectively held everyone hostage, and forced everyone hosting container images and wanting to be online, to trust their builds”
“Chainguard should be praised for this. It was a different company that leaked the POC early”
“Very irresponsible behaviour in my opinion”
“They didn’t get to unilaterally decide that the embargo was inconvenient and publish early.”
“Chainguard unilaterally broke the embargo and published built images containing the fix.”
“Good. Coordinated disclosure meant that people couldn't protect themselves.”
“I struggle to see justification for this, even with the chaos approaching the coordinated release.”
“Chainguard unilaterally broke the embargo and published built images containing the fix”
“Good luck getting them to fix broken packages though.”
“thats chainguard’s entire value prop (they are quite well known in this sphere)”
“Chainguard recently delete most of the cloud native application in their community repository”
“Because Chainguard cost an arm and a leg.”
“I’ve become super sold on the benefits of minimal and continually patched images”
“Chainguard based images, packages and libraries are first line of defense.”
“If I was a Chainguard customer I would be very worried that they seem to notknow how image scanners work.”
“using 100s of thousands on chainguard”
“chainguard is not full-source bootstrapped”
“while the are open source they are less straightforward to follow”
“variations on what Chainguard has already proven”
“Chainguard offered images that report 0 CVEs and would basically remove this barrier.”
“Chainguard can only guarantee zero active exploits because they control their own exploit feed”
“Chainguard still has better CVE response time and can better guarantee you zero active exploits found by your prod scanners.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.