Owning Wolfi Enables Faster Patching

Owning Wolfi lets Chainguard behave like a software factory, not just a scanner layered on top of someone else’s base image. When a flaw lands in Go, glibc, or OpenSSL, Chainguard can patch the package, rebuild the affected Wolfi packages and container images automatically, and publish updated images without waiting for Ubuntu or Red Hat to accept, package, test, and ship the fix on their own schedule.1 2 3 4 5

• Wolfi was built specifically for containers, with a minimal filesystem and apk packages. That matters because fewer packages means fewer things to patch, and owning the package recipes means Chainguard can rebuild from source nightly and on new upstream releases instead of inheriting a general purpose distro backlog.2 3 4
• Vendors built on Ubuntu or similar bases move one step later in the chain. Ubuntu does publish security fixes quickly, but its updates still run through distro maintenance and release processes. Chainguard’s model cuts out that dependency for the packages inside its own images.5 6 7
• This speed advantage is product level, not just operational. Chainguard sells continuously updated images and patch SLAs, while rivals like Docker, Wiz, and Snyk more often start from scanning, registry distribution, or layered security tooling. Faster remediation is the core thing enterprises are paying for.1 3 8

The next step is broader control over more of the software stack. As Chainguard extends the same rebuild and patch pipeline from base images into libraries and virtual machines, the company can turn patch speed into a wider platform advantage, especially in regulated environments where every day of exposure matters.1 3 8