I've attended a local CNCF meetup where the chainguard folks presented Wolfi and their related tools to create container images and SBOMs.
I was already skeptical of the product, having heard of it before. Unfortunately, attending that talk confirmed to me that they've just re-invented a severely limited version of Nix powered by yaml files that can output SBOMs in a standard format.
Their software repository only has around 500 packages vs the 80k+ in nixpkgs. When I read "Alpine Linux", I was immediately reminded of its use of the musl libc which has endless DNS resolution issues[1][2] in and outside of Kubernetes, however, thankfully, it seems like they realized bundling musl was a bad idea and ship glibc instead.
I'll stick to Nix and nixpkgs to build my reproducible container images with full dependency graphs back to the source code.
I was already skeptical of the product, having heard of it before. Unfortunately, attending that talk confirmed to me that they've just re-invented a severely limited version of Nix powered by yaml files that can output SBOMs in a standard format.
Their software repository only has around 500 packages vs the 80k+ in nixpkgs. When I read "Alpine Linux", I was immediately reminded of its use of the musl libc which has endless DNS resolution issues[1][2] in and outside of Kubernetes, however, thankfully, it seems like they realized bundling musl was a bad idea and ship glibc instead.
I'll stick to Nix and nixpkgs to build my reproducible container images with full dependency graphs back to the source code.
1: https://martinheinz.dev/blog/92
2: https://news.ycombinator.com/item?id=35058094