GOTO - The Brightest Minds in Tech

State of the Art of Container Security • Adrian Mouat & Charles Humble

Mar 27, 2026
Guest
Adrian Mouat
Adrian Mouat, Developer Relations at Chainguard and author of Using Docker, focuses on container security and minimal distroless images. He discusses why base images go stale and how smaller images reduce risk. He explains building from source with Wolfi, the role and limits of SBOMs and attestations, and practices like immutability, short-lived credentials, and signing for safer supply chains.
Ask episode
AI Snips
Chapters
Books
Transcript
Episode notes
INSIGHT

Build From Source For Provenance

  • Building packages from source gives provenance and granular control, reducing hidden supply-chain risk.
  • Adrian Mouat explains Chainguard's Wolfi distribution builds everything from source and uses APKO to assemble minimal APK-based images.
ADVICE

Redeploy Fresh Images Not In-Place Updates

  • When an image needs updating, redeploy a fresh image rather than running in-place package updates.
  • Adrian Mouat references Google's practice of regularly replacing services to avoid accumulating outdated libraries and vulnerabilities.
INSIGHT

SBOMs Help Traceability But Need Coverage

  • SBOMs list software and versions but are limited until industry-wide coverage and tooling improve.
  • Adrian Mouat says Chainguard generates SBOMs at build time (not after the fact), improving accuracy and traceability for images they produce.
Get the Snipd Podcast app to discover more snips from this episode
Get the app