Reviews from AWS Marketplace
0 AWS reviews
-
5 star0
-
4 star0
-
3 star0
-
2 star0
-
1 star0
External reviews
External reviews are not included in the AWS star rating for the product.
Chainguard has changed the game when it comes to remediating vulns in images.
What do you like best about the product?
I love the ease of use for our dev teams to switch over and cut their vulnerabilities down. Integrating it into our pipelines has been very easy. Customer support has been excellent and responsive.
What do you dislike about the product?
At this time of using the product I do not have any dislikes
What problems is the product solving and how is that benefiting you?
Teams have been struggling to bring their vulnerabilities down on their images. This takes so much off their plates and not having to worry about it.
- Leave a Comment |
- Mark review as helpful
Looking for the best distroless images on the market? Chainguard is the way to go!
What do you like best about the product?
I wrote a paper on container image security, evaluating the security of containers through reduction of potentially vulnerable components. It concludes that the usage of component reduction methods significantly reduces the amount of security vulnerabilities within container images. It also finds that, even though the probability of exploitation of the majority of vulnerabilities found by scanners is very low, employing them still is a strategically sound decision. When comparing different images with component reduced (i.e. "distroless images") alternatives, chainguard did by far the best job. As a consultant supporting product security teams in large enterprises we are recommending to integrate chainguard images to development teams and decision makers. It will save a lot of dicsussions, headaches and money!
Please find the paper here: https://mwager.de/assets/component_reduction_paper.pdf
Please find the paper here: https://mwager.de/assets/component_reduction_paper.pdf
What do you dislike about the product?
Nothing so far. Have a look at the paper, it clearly shows that Chainguard did the best job compared to all other alternatives.
What problems is the product solving and how is that benefiting you?
Chainguard provides container images containing zero CVEs (security vulnerabilities within the supply chain) for a lot of relevant runtimes and popular services, is easy to use and integrate and also provides excellent documentation.
Minimal and easy to use
What do you like best about the product?
Our workloads are entirely statically linked binaries so we were looking for a minimal base image and Chainguard's static image perfectly fits the bill.
What do you dislike about the product?
We don't use other chainguard images since we'd only have access to the latest image, and our infrastructure relies heavily on reproducibility which we can't guarantee with floating tags.
What problems is the product solving and how is that benefiting you?
Never having to worry about CVEs in our main application container images.
Excellent solution to a significant security problem
What do you like best about the product?
Knowing what's actually running in the container images you're using in your infrastructure has always been a security weakness of the container ecosystem. Chainguard makes it relatively simple to verify that your imagines are clean of significant vulnerabilities.
What do you dislike about the product?
The system is as good as practically possible but, at the end of the day, you're still relying on outsiders for your security.
What problems is the product solving and how is that benefiting you?
Chainguard makes it possible to ensure the container images you use are clean of vulnerabilities.
Secure-by-Design Exemplified
What do you like best about the product?
There's a lot of talk about Secure-by-Design software in the industry. That said, Chainguard moves beyond the talk and walks the walk with their Chainguard images and innovative approaches to software supply chain security. Rather than just focusing on identifying and reporting on vulnerabilities, Chainguard gets to the root of the issue, driving down vulnerabilities exponentially and enabling Developers to build on a secure foundation, eliminating toil, reducing attack surface and benefiting the entire software ecosystem.
What do you dislike about the product?
There's not much to dislike about Chainguard other than the industry needed them sooner.
What problems is the product solving and how is that benefiting you?
Eliminating hundreds and thousands of known vulnerabilities and enabling Secure-by-Design cloud-native application workloads.
The future of container development
What do you like best about the product?
Chainguard's open source tooling allows developers, and opportunity to package their projects in secure, efficient containers. When working on my personal projects, I now default to using melange and apko for all of my containers.
What do you dislike about the product?
Sometimes documentation is lacking for advanced features or portions of their open source tooling.
What problems is the product solving and how is that benefiting you?
Chainguard has released their alternative values for Big Bang, addressing over 2000 CVEs and massively reducing the footprint of the image deployment bundle.
Secure software supply chain
What do you like best about the product?
Chainguard has a rock solid product offering that's allowed our teams to build on top of a secure foundation. Chainguard's Linux (un)distro and vast library of language runtimes and open source building blocks allowed us to compose a secure software catalog of first and third party software to distribute to our customers. On top of this, all of Chainguard's engineering and customer success staff have been a great pleasure to work with! All our collab is over Slack and they feel like an extended part of the team.
What do you dislike about the product?
This falls more to us than Chainguard, but ways to better track all the places we're making use of their base images would be helpful.
What problems is the product solving and how is that benefiting you?
Chainguard helps our engineering teams secure our software supply chain and build on top of "sanitized" open source.
Best in the business
What do you like best about the product?
Removes the complexity from dealing with CVEs from the development process, allowing teams to ship high quality software without compromising security or speed.
What do you dislike about the product?
Nothing - they are my go-to recommendation when teams are struggling in the process.
What problems is the product solving and how is that benefiting you?
Chainguard buys down time and complexity in the container security and CVE process, allowing software to rapidly achieve security requirements and deploy into secure environments
Spend less time talking about CVEs
What do you like best about the product?
We've all seen a ton of projects that will detect CVEs but then you have the secondary problem of deciding where the CVE originated from (base image or first party code), how to patch or upgrade, when to patch so not to impact customers, who should own the updates, what to tell customers and compliance...
Chainguard Images removes the CVEs -- no debate, no CVSS, no triaging, no work tickets. It's done. Enterprises that appreciate this problem will see an ROI in weeks if not days. Not to mention that enterprise customers get an SLA for patches -- I challenge anyone to do what they are doing internally without spending millions on a team who does this as a full time job.
Then for the orgs that are investing in the software supply chain risks, they provide provenance, signing, and an accurate SBOM out-of-The box to start your journey in managing a secure software supply chain.
Chainguard Images removes the CVEs -- no debate, no CVSS, no triaging, no work tickets. It's done. Enterprises that appreciate this problem will see an ROI in weeks if not days. Not to mention that enterprise customers get an SLA for patches -- I challenge anyone to do what they are doing internally without spending millions on a team who does this as a full time job.
Then for the orgs that are investing in the software supply chain risks, they provide provenance, signing, and an accurate SBOM out-of-The box to start your journey in managing a secure software supply chain.
What do you dislike about the product?
The free offering is (reasonably) only the :latest tag which might be fine for personal projects but not most production environments. I don't know the costs for individuals or small orgs (I'm an enterprise customer) but its not free.
What problems is the product solving and how is that benefiting you?
This solves a major piece of our compliance story. We need to demonstrate to compliance that we are properly managing CVEs that are impacting our customers. It's also planned to rolled out everywhere in our org as part of a Gold Image project.
Chainguard’s container images, towards effortless and strong security posture
What do you like best about the product?
I was looking for replacing my base images with more a secure approach (i.e. distroless), Chainguard images were a great fit because easy to use and well maintained. The other aspect is the customer support that the Chainguard team is providing, even with the free container images. As an example, they took my feedback, answered my questions as well as educated around the different concepts.
What do you dislike about the product?
Not yet widely used out there, but it's coming as more awareness and education are provided and shared. I haven't built my own container image with wolfi, melange and apko yet, as I will to spend more time to get started with them.
What problems is the product solving and how is that benefiting you?
Chainguard is helping by default and effortless to improve my security posture with my container images.
showing 11 - 20