Top all-time · #1817
Chainguard: Unchained
Company blog · chainguard.dev/unchainedsecurityprogramming
Chainguard: Unchained is the company blog at chainguard.dev, writing about security and programming. Since 2021, 41 different Hacker News readers have linked it 78 times, most often “The Hardest Fork”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (20) to say how often HN recommends it.?
Why HN links it
HN readers link Chainguard's Unchained blog for posts on supply-chain security, minimal container images, bootstrapping compilers, and changes to Wolfi, MinIO and kaniko. Comments mostly cite the posts as support rather than praise them.
Summarised by Claude from a sample of 20 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Chainguard provides trusted open source artifacts for every layer of your modern software stack—containers, language libraries, and VM images.
Most-linked posts?
- /4 people · 4 mentions · first linked 2024-04-06
- The Hardest Fork4 people · 4 mentions · first linked 2026-05-29
- Building the first memory safe distro3 people · 3 mentions · first linked 2023-01-25
- Wolfi – Linux (Un)distro designed for securing the software supply chain3 people · 3 mentions · first linked 2022-09-22
- /unchained/scaling-chainguard-images-with-a-growing-catalog-and-proactive-security-updates2 people · 2 mentions · first linked 2023-06-27
- /libraries2 people · 2 mentions · first linked 2025-09-19
- Gastown, and where software is going2 people · 2 mentions · first linked 2026-01-21
- GitHub Fixes Information Leak Bug in Its Container Registry2 people · 2 mentions · first linked 2023-01-23
- Fully bootstrapping Java from source in Wolfi2 people · 2 mentions · first linked 2023-06-02
- What the Fork? Imposter Commits in GitHub Actions and CI/CD2 people · 2 mentions · first linked 2023-03-08
What Hacker News says?
> What's next? "$X isn't patching this CVE fast enough, here's a binary blob of our fix [...]" https://www.chainguard.dev/athena https://www.chainguard.dev/unchained/this-shit-is-hard-build...
Comment linking /unchained/this-shit-is-hard-building-forkstore
on “Today's PHP security release, and how we're strengthening security”Submitted Chainguard Images now available on Docker Hub as a story · 79 points
HN discussionI'd expect it to be harder. I used to work on a large embedded device that ran some Java code, and there was a specialist vendor providing Java for the offbeat processor platform. After a little digging, I found a blog post about it, and it does sound denser than the poster's plans to bootstrap Rust: https://www.chainguard.dev/unchained/fully-bootstrapping-jav...
Comment linking /unchained/fully-bootstrapping-java-from-source-in-wolfi
on “Writing a Rust compiler in C”Submitted Software dark matter is the enemy of software transparency as a story · 77 points
HN discussionChainguard | Senior and Staff-level Product Managers and Engineers, and Engineering Managers | REMOTE (US/CAN) We're building the safe, trusted source for open source. We created the secure Container Image market and we've recently expanded into VMs and Libraries for popular language ecosystems such as JavaScript, Python, and Java. We're hiring quite a few PMs and engineers for our Containers and Libraries products,…
Comment linking /careers
on “Ask HN: Who is hiring? (December 2025)”Submitted Working as unexpected as a story · 33 points
HN discussionIIUC chainguard is this, but only for python, java, and docker images so far. https://www.chainguard.dev/libraries
Comment linking /libraries
on “Pnpm has a new setting to stave off supply chain attacks”Submitted Vulnerability-Free Raspberry Pi Image on Chainguard OS as a story · 30 points
HN discussionhttps://www.chainguard.dev/
Comment linking /
on “TanStack NPM Packages Compromised”Submitted OCI announces upcoming changes for registries as a story · 25 points
HN discussionIs this a response to Chainguard? https://www.chainguard.dev/
Comment linking /
on “Canonical's 'distroless' Linux images are a game-changer for enterprises”Submitted Software Dark Matter Is the Enemy of Software Transparency as a story · 8 points
HN discussionfyi, the good chainguard folks (and former googlers who started kaniko) have forked kaniko Blog post: https://www.chainguard.dev/unchained/fork-yeah-were-bringing... The fork: https://github.com/chainguard-dev/kaniko
Comment linking /unchained/fork-yeah-were-bringing-kaniko-back
on “Yamlfmt: An extensible command line tool or library to format YAML files”Submitted The Principle of Minimalism as a story · 7 points
HN discussionI'm very sorry that we broke things for you. To be clear, nothing has changed with Wolfi. Wolfi is an open source community project and everything is still available there: https://github.com/wolfi-dev/ . We have made changes to Chainguard Images - our commercial product built on top of Wolfi - which mean you can no longer pull images by tag (other than latest). Chainguard images are rebuilt everyday and have a not…
Comment linking /unchained/a-guide-on-how-to-use-chainguard-images-for-public-catalog-tier-users
on “Musl 1.2.4 adds TCP DNS fallback”Submitted Secure containers market: from men's room at Taylor Swift concert to NBA finals as a story · 5 points
HN discussionI was using wolfi for an oss project, but the recent attempts at forcing payments when pinning version was a huge red flag, as was the messaging around it, and I’ll be migrating away from it. https://www.chainguard.dev/unchained/scaling-chainguard-imag... Pinning a language version (say python 3.11) isn’t an optional thing its a best practice, and the notion that its because of security seems intentionally misleadin…
Comment linking /unchained/scaling-chainguard-images-with-a-growing-catalog-and-proactive-security-updates
on “Musl 1.2.4 adds TCP DNS fallback”Submitted Wolfi – Linux (Un)distro designed for securing the software supply chain as a story · 5 points
HN discussion> When it appears in diverse multiple places simultaneously, I generally believe someone is coordinating a media campaign. You may think that's paranoid but look at the merits of the argument: how else is it explained? They didn't coincidentally think of the exact same argument This counterargument? I think my comment still applies. One of them had an original thought and the other copied them. However, on further r…
Comment linking /
on “A stealth attack came close to compromising the Internet”Submitted Chainguard, Inc as a story · 5 points
HN discussionMaybe the author isn't aware that Chainguard is going to keep patching MinIO for CVEs: https://www.chainguard.dev/unchained/secure-and-free-minio-c... You wouldn't get the other changes in this post (e.g., restoring the admin console) but that's a bit orthogonal.
Comment linking /unchained/secure-and-free-minio-chainguard-containers
on “MinIO Is Dead, Long Live MinIO”Submitted Busting 5 Sigstore Myths as a story · 4 points
HN discussionWe're taking a very different[1] approach at Chainguard. Essentially: building the world from GitHub repos on SLSA L2 hardened infra and delivering directly to our customers to bypass the registry threat vector (which is where vast, vast majority of attacks occur—we'll be blogging about this soon with more data). [1] https://www.chainguard.dev/unchained/announcing-chainguard-l...
Comment linking /unchained/announcing-chainguard-libraries-for-javascript-malware-resistant-dependencies-built-securely-from-source
on “crates.io: Malicious crates faster_log and async_println”Submitted Open source died in March. It just doesn't know it yet as a story · 3 points
HN discussionIt's a challenge but seems to be becoming moire prevalent for folks focused on supply chain attacks. Chainguard in particular has a bunch of standard containers (e.g. nginx) that reduce the container footprint as much as possible. https://www.chainguard.dev/chainguard-images
Comment linking /chainguard-images
on “Build Your Own Docker with Linux Namespaces, Cgroups, and Chroot”Submitted The Hardest Fork as a story · 2 points
HN discussion> Anyone know of a better way to protect yourself than setting a min release age on npm/pnpm/yarn/bun/uv (and anything else that supports it)? Most of these attacks don't make it into the upstream source, so solutions[1] that build from source get you ~98% of the way there. If you can't get a from-source build vs. pulling directly from the registries, can reduce risk somewhat with a cooldown period. For the long tai…
Comment linking /libraries
on “Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain”Submitted The hardest fork as a story · 2 points
HN discussionPersonally? I've done quite a bit here although there's always more. I worked at Google to fund Rust development internally and externally, helped sponsor the work that eventually led to getting Rust adopted in the Linux kernel, and now run a company that's building a new Linux distribution that prioritizes shipping code written in memory safe languages. https://security.googleblog.com/2021/02/mitigating-memory-sa..…
Comment linking /unchained/building-the-first-memory-safe-distro-wolfi
on “CWE Top Most Dangerous Software Weaknesses”Submitted Open source "died" in March. It just doesn't know it yet as a story · 2 points
HN discussion
