Wolfi: A Secure-by-Default Distro for Curing Container CVE Chaos

The talk opens with the problem: popular base and application images from public registries often carry hundreds of known vulnerabilities, driven by large dependency trees and outdated packages. The speaker argues that most of a modern software stack is open-source code that teams rarely examine, and that routine cleanup such as running package updates and removing archives barely reduces the CVE count. Scan comparisons across popular language and application images illustrate the gap against purpose-built images.

The middle of the talk surveys how containers are commonly built, from standard Dockerfiles to distroless approaches and tools such as ko, Jib and Bazel. Distroless images still have gaps, since some ship with shells, package managers or vulnerable binaries. Wolfi is presented as a rolling, container-focused Linux distribution that uses the APK package format, publishes SBOMs and signed attestations, and rebuilds packages quickly when upstream patches land. The live demo shows a Python Flask application built the Docker way, then as a drop-in Wolfi image, and then assembled with apko from packages built with melange.

The takeaway for practitioners is that a declarative, reproducible build pipeline can produce smaller images with fewer known vulnerabilities and a verifiable build history. Debugging is best done before an image reaches production, using the exact package and image digest. The talk also notes that the tools run as standalone Go binaries without a container runtime for the build step.