Chainguard

Founded in 2021 by, among others, Dan Lorenc and Kim Lewandowski, formerly at Google where they drove the work on Sigstore and SLSA. Chainguard inverts the problem: instead of scanning vulnerabilities away after the fact, it ships Chainguard Images — minimal container images built on the Wolfi undistro, signed, carrying an SBOM and aiming for zero known CVEs.

The reasoning is that the cheapest way to avoid a vulnerability is never to ship the package that carries it — the same logic behind distroless. The images are rebuilt continuously, so a new CVE is often patched before most people finish reading the advisory. Supply-chain security turned into a subscription.