https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/Recent content in Learning Labs onHugo -- gohugo.ioen-USWed, 18 Jun 2025 21:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202603/Mon, 30 Mar 2026 12:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202603/The March 2026 Learning Lab with Manfred Moser focuses on the history, trends, and future developments around software supply chain attacks. Manfred talks about the role libraries for application developers and demonstrates numerous new features and use cases for Chainguard Libraries. Sections 0:00 Introduction and agenda 1:45 Software supply chain overview 7:25 History of attacks and overview of different methods 17:59 Future threads and trends 21:37 Statistics about intensifying attacks 22:54 Incidents and fire drills 25:05 Impact from Minecraft and log4j on Maven Central 26:42 Chainguard Libraries overview 32:21 Chainguard Libraries for Python, Java, and JavaScript 35:17 Demo - Browsing libraries in the console UI 40:38 Demo - Pull token creation in console UI and with chainctl 42:13 Demo - Browsing Python simple index 45:50 Demo - Browsing Java repository 49:25 Demo - Example projects for JavaScript and Python 56:35 Demo - Verification with chainctl 58:47 Chainguard Repository 1:01:16 Upcoming events Resources Slide deck Chainguard Libraries documentationhttps://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202512/Wed, 17 Dec 2025 17:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202512/The December 2025 Learning Lab with Erika Heidi focuses on strategies to improve the security of your software supply chain and ship safer container runtimes in 2026. Sections 00:00 Intro 02:52 Why Devs need to care 04:48 XZ Utils incident 09:43 tj-actions/changed-files incident 12:42 Sha1-Hulud Second Coming 17:11 Trending threat models 32:42 Mitigating risks 45:02 Concrete Dev actions this sprint 50:47 Chainguard Containers: CVE Comparisons Resources Slide deck Chainguard Containers Overview Chainguard Libraries Overview Migrating to Chainguard Containers How to Use Container Image Digests to Improve Reproducibility Keep your Chainguard Containers Up to Date with digestabot Using Renovate with Chainguard Containers Images Directoryhttps://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202511/Fri, 21 Nov 2025 17:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202511/The November 2025 Learning Lab with Erika Heidi covers the release of Chainguard OS for the Raspberry Pi, showing how Chainguard OS has evolved to power new environments. Sections 0:46 Presentation Starts 2:55 How We Got Here: Wolfi and Chainguard OS 5:47 Presenting Chainguard OS for the Raspberry Pi 8:42 How to Set Up your Raspberry Pi with Chainguard OS 11:23 Grype scan on the Raspberry images 14:47 Demo Overview: Guardcraft Pi 18:10 Grype scan on the Guardcraft image 20:59 Live Demo: Minecraft server on the Raspberry Pi 24:14 Demo Overview: Open Source LLM server 30:51 Grype scan on the wolfi-llama image 32:35 Live Demo: Open Source Llama.https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202510/Thu, 30 Oct 2025 12:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202510/The October 2025 Learning Lab with Manfred Moser covers Chainguard Libraries for JavaScript and CVE remediation with Chainguard Libraries for Python. It starts with an overview about libraries and the JavaScript ecosystem and moves on to a demo with npm and pnpm. In the second section Manfred explains the approach for CVE remediation and shows an example project with remediation and scanning with grype. Sections 0:00 Introduction 1:55 Agenda 2:54 Secure container and the role of libraries 5:20 Software supply chain for libraries and security 6:51 Chainguard Libraries and the JavaScript ecosystem 14:33 Malware in the npm ecosystem 18:39 Chainguard Libraries for JavaScript 25:57 Demoes with npm and pnpm 33:50 Troubleshooting results and additional demos 41:34 Chainguard Libraries for Python 43:39 CVE remediation process and examples 52:03 Demoes with uv and grype 56:25 Further resources 57:35 Next up 58:18 Questions 1:06:00 Wrapping up JavaScript demo The demonstration of Chainguard Libraries for JavaScript walks through the minimal example for pnpm with direct access to the registry and with access to a local repository manager, and shows an equivalent project with npm as well.https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202509/Sun, 28 Sep 2025 21:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202509/The September 2025 Learning Lab, led by Adrian Moat, focuses on minimizing the attack surface of container images by adopting Chainguard’s static and minimal images, which boast zero known CVEs. Adrian demonstrated a container build for a Go-based application and explains more complex use cases. Sections 00:01 Welcome and introductions 03:34 Talk outline and prerequisites 04:34 Understanding CVEs 07:34 Introducing Chainguard Containers 08:58 Vulnerability and size comparison 10:14 Why Chainguard images are more secure 11:46 Practical demo: Migrating a Go container image 15:01 Initial build 17:59 Migration to Chainguard base image 20:45 Multi-stage build and static image optimization 27:39 Static vs.https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202508/Thu, 28 Aug 2025 17:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202508/The August 2025 Learning Lab with Erika Heidi covers DFC, or Dockerfile Converter, an open source tool created by the Chainguard team to facilitate migration to Chainguard Containers. In this session, learn how to install and use DFC to effectively convert your Dockerfiles to use minimal container images from Chainguard. Erika demonstrates how to use various flags to customize DFC’s output and also how to connect the DFC MCP server to your AI assistant to have DFC functionality integrated within your current AI workflow.https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202507/Thu, 24 Jul 2025 17:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202507/The July 2025 Learning Lab with Patrick Smyth covers AI with Hardened Container Images. In this session, learn how to secure AI workloads by reducing vulnerabilities in container images by over 90%. Patrick demonstrates hands-on techniques for training an animal detection model using PyTorch with hardened container images, creating minimal and secure deployments, and running AI frameworks with zero CVEs. Sections 0:00 Introduction and updates 2:02 Preparation: Docker pull instructions for demo 3:39 Chainguard!https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202506/Sun, 22 Jun 2025 17:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202506/The June 2025 Learning Lab with Patrick Smyth covers Chainguard Libraries for Python. Open source libraries help you move fast, but pulling in external dependencies can introduce supply chain risk. This session covers fundamental concepts of Chainguard Libraries, package managers and dependencies, PyPI and build tools, configuring repository managers, and running example application builds. Sections 0:00 Introduction and welcome 0:54 Patrick Smyth introduction and background 1:47 Chainguard! Who are we? 2:47 Chainguard Containers and the “boss assigned me to fix Ubuntu” problem 4:12 Introduction to Chainguard Libraries for Python 5:04 Python libraries fundamentals - modules, packages, and libraries 6:34 The dependency graph problem and modern ecosystem challenges 8:57 PyPI (Python Package Index) overview and infrastructure 10:53 Supply chain attacks on the rise and threats to the Python ecosystem 11:39 Supply chain meme calendar - an attack every month this year 13:54 Anatomy of supply chain attacks and attack vectors 17:43 Chainguard Libraries!https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202505/Wed, 18 Jun 2025 21:00:00 +0000https://deploy-preview-3155--ornate-narwhal-088216.netlify.app/software-security/learning-labs/ll202505/The May 2025 Learning Lab with Manfred Moser covers Chainguard Libraries for Java. It starts with an overview about libraries and the Java ecosystem and progresses to a demo with Apache Maven and Sonatype Nexus. Sections 0:00 Introduction and agenda 2:38 Chainguard and containers 3:47 Chainguard Factory 4:57 Concepts - from containers to libraries 9:00 Java and Java libraries 12:45 Software supply chain of libraries and attacks 19:27 Dependency supply in Java 20:30 Repository concept and Maven Central 24:32 Chainguard Libraries for Java and repository manager intro 28:17 Developer tools 29:21 Demo start and setup with chainctl 32:55 Sonatype Nexus configuration 37:30 Maven configuration 40:41 Example project setup, build, and results 44:57 Dependency list and tree 47:00 Results and verification 49:37 Summary 50:43 Up next 52:55 Questions Demo Following are some of the commands used in the demo.