Migrating to Chainguard Images: less CVEs for safer container runtimes
Tags: php, docker, security, containers
Published: 2024-04-17 17:25:44

---
title: Migrating to Chainguard Images: less CVEs for safer container runtimes
published: true
description: A look into software supply chain, CVEs, and how to create safer container runtimes 
tags: php, docker, security, containers
cover_image: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/95rcg8qpy4ptcgzjvkf2.png
# Use a ratio of 100:42 for best results.
# published_at: 2024-04-12 11:21 +0000
---

Software supply chain attacks have become common in the industry lately, with the latest episode featuring the infamous [CVE-202403904](https://nvd.nist.gov/vuln/detail/CVE-2024-3094) and the [xz's backdoors](https://www.chainguard.dev/unchained/if-xzs-backdoors-are-inevitable-how-do-we-stay-secure-the-answer-is-move-faster). 

Whether malicious or unintentional, a [CVE](https://edu.chainguard.dev/software-security/cves/cve-intro/) can pose as severe risk to organizations relying on a piece of affected software. The CVE database has over 200.000 entries and it just scratches the surface, since unreported exploitable vulnerabilities (a.k.a. [zero-days](https://en.wikipedia.org/wiki/Zero-day_vulnerability)) are a fairly common occurrence in the hacking scene.

For a long time, this was not a developer's concern. But with the explosion of open source third-party software dependencies, it is virtually impossible to keep track and know everything that is included within a software artifact, whether we're talking about a single package or a whole operating system. Just as in other industries, a compromise in any point of your supply chain represents an issue that may be exploited by bad actors.

## Less CVEs for safer container runtimes
It is a no-brainer that using a container image with less CVEs is **better** for security. Reducing the surface for attack has proven to be an effective way of creating safer container runtimes.

Consider the `php:alpine` image, which is known for being a smaller image when compared to Debian and Ubuntu variants:

![Screenshot shows output from the command "grype php:alpine", showing a total of 20 medium severity and 1 high severity CVEs.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nhxrgy6pt4ssm9m97a2y.png)

Now let's have a look at this image's Chainguard equivalent, the `cgr.dev/chainguard/php:latest` image:

![Screenshot shows output from the command "grype cgr.dev/chainguard/php", showing 1 medium severity and 1 high severity CVEs.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/boawd4e30rb6e4fdjubz.png)

It's worth noting that these numbers fluctuate naturally as new CVEs come out and new patches are available by package vendors. The following graph shows a 30-day comparison between `php:latest` and `cgr.dev/chainguard/php`, for another perspective (live version available [here](https://edu.chainguard.dev/chainguard/chainguard-images/vuln-comparison/php/)):

![Screenshot shows month comparison between php:latest and cgr.dev/chainguard/php](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4aq6tyj06wru1suufdik.png)

So how is this possible? We could say the secret sauce of Chainguard Images is a drastically reduced surface for attack, but that is just one of the many ingredients that make these images stand out in terms of container security. Provenance attestation is another important feature that provides a way to verify the image comes from where it should. 

### Resources to Learn More
The [Migrating Dockerfiles to Chainguard Images](https://edu.chainguard.dev/chainguard/migration/migrating-to-chainguard-images/) guide has a high-level overview with a couple examples showing how you can migrate from other base images to Chainguard Images. We  have also a dedicated [PHP Migration Guide](https://edu.chainguard.dev/chainguard/migration/migrating-php/) you can use as reference when migrating PHP Dockerfiles to Chainguard Images.  

If you'd prefer a more hands-on experience, I'll be presenting a [Learning Labs workshop](https://www.crowdcast.io/c/learninglabs-apr24) next week (Tuesday April 23, 12PM ET / 6PM CEST) about this topic. We'll talk a bit about CVEs, software supply chain security, and then I'll dive into some live demos showing all you need to know for a streamlined migration process. Hope to see you there! You can [register here](https://www.crowdcast.io/c/learninglabs-apr24) to save a spot.