├── .chainguard ├── gen-html.sts.yaml └── source.yaml ├── .github ├── chainguard │ └── gen-html.sts.yaml └── workflows │ └── gen-html.yml ├── .gitignore ├── LICENSE ├── README.md ├── comparison-go.html ├── comparison-nginx.html ├── comparison-php.html ├── comparison.css ├── comparison.template.html └── gen-html.sh /.chainguard/gen-html.sts.yaml: -------------------------------------------------------------------------------- 1 | issuer: https://token.actions.githubusercontent.com 2 | subject: repo:chainguard-dev/image-comparison:ref:refs/heads/main 3 | claim_pattern: 4 | job_workflow_ref: chainguard-dev/image-comparison/.github/workflows/gen-html.yml@refs/heads/main 5 | 6 | permissions: 7 | contents: read 8 | -------------------------------------------------------------------------------- /.chainguard/source.yaml: -------------------------------------------------------------------------------- 1 | # Copyright 2022 Chainguard, Inc. 2 | # SPDX-License-Identifier: Apache-2.0 3 | 4 | spec: 5 | authorities: 6 | - keyless: 7 | identities: 8 | - issuer: https://accounts.google.com 9 | - issuer: https://github.com/login/oauth 10 | - issuer: https://token.actions.githubusercontent.com 11 | subject: https://github.com/chainguard-dev/image-comparison/.github/workflows/gen-html.yml@refs/heads/main 12 | - key: 13 | # allow commits signed by GitHub, e.g. the UI 14 | kms: https://github.com/web-flow.gpg 15 | -------------------------------------------------------------------------------- /.github/chainguard/gen-html.sts.yaml: -------------------------------------------------------------------------------- 1 | issuer: https://token.actions.githubusercontent.com 2 | subject: repo:chainguard-dev/image-comparison:ref:refs/heads/main 3 | claim_pattern: 4 | job_workflow_ref: chainguard-dev/image-comparison/.github/workflows/gen-html.yml@refs/heads/main 5 | 6 | permissions: 7 | contents: write 8 | -------------------------------------------------------------------------------- /.github/workflows/gen-html.yml: -------------------------------------------------------------------------------- 1 | name: gen-html 2 | 3 | on: 4 | workflow_dispatch: {} 5 | schedule: 6 | # runs twice daily, at 01:00 UTC and 13:00 UTC 7 | - cron: '0 1 * * *' 8 | - cron: '0 13 * * *' 9 | 10 | permissions: {} 11 | 12 | jobs: 13 | build: 14 | runs-on: ubuntu-latest 15 | permissions: 16 | id-token: write # Needed for gitsign auth 17 | contents: write # Needed to commit files back to repo 18 | steps: 19 | - name: Harden the runner (Audit all outbound calls) 20 | uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 21 | with: 22 | egress-policy: audit 23 | 24 | - name: checkout repo content 25 | uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.2 26 | - uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # v0.3 27 | - uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0 28 | - name: setup python 29 | uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0 30 | with: 31 | python-version: '3.12' 32 | - name: Set up Octo-STS 33 | uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0 34 | id: octo-sts 35 | with: 36 | scope: chainguard-dev/image-comparison 37 | identity: gen-html 38 | - name: execute shell script 39 | id: run 40 | run: | 41 | ./gen-html.sh 42 | - name: gitsign 43 | uses: chainguard-dev/actions/setup-gitsign@ec48ea414c0cb207549029d8fe35f8f01e563219 # v1.0.8 44 | - name: commit files 45 | run: | 46 | git add *.html 47 | git commit -m "update html" 48 | git push origin main 49 | - if: ${{ failure() && github.event_name == 'schedule' }} 50 | uses: rtCamp/action-slack-notify@b24d75fe0e728a4bf9fc42ee217caa686d141ee8 # v2.2.1 51 | env: 52 | SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }} 53 | SLACK_COLOR: '#8E1600' 54 | MSG_MINIMAL: 'true' 55 | SLACK_TITLE: gen-html failed. 56 | SLACK_MESSAGE: | 57 | For detailed logs: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }} 58 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | __pycache__/* 2 | # use --force to update data.csv 3 | # this file is in .gitignore since there will be 4 | # many times a programmer runs main.py but does not 5 | # actually want to update.csv 6 | data.csv 7 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # image-comparison 2 | 3 | Comparison of [Chainguard Images](https://github.com/chainguard-images) 4 | to others 5 | 6 | ## Overview 7 | 8 | We run security scans using [grype](https://github.com/anchore/grype) 9 | against the following images: 10 | 11 | - `golang:latest` 12 | - `nginx:latest` 13 | - `php:latest` 14 | - `cgr.dev/chainguard/go:latest` (Chainguard) 15 | - `cgr.dev/chainguard/nginx:latest` (Chainguard) 16 | - `cgr.dev/chainguard/php:latest` (Chainguard) 17 | -------------------------------------------------------------------------------- /comparison-go.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Chainguard Image Comparison | Go 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 |
19 |
Chainguard Go Image
20 |
21 |
22 |
CVEs
23 |

2

24 |
25 |
26 |
Size
27 |

283MB

28 |
29 |
30 |
Age
31 |

32 |
33 |
34 |
35 |
Upstream Go
36 |
37 |
38 |
39 |
40 |
41 |
CVEs
42 |
43 |
44 |
Size
45 |
46 |
47 |
Age
48 |
49 |
50 |
51 |
52 |

363

53 |
54 |
55 |

294MB

56 |
57 |
58 |

59 |
60 |
61 |
62 |
63 |
64 | Generated from opensource dataset 65 |
66 |
67 | 68 | 69 | -------------------------------------------------------------------------------- /comparison-nginx.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Chainguard Image Comparison | Nginx 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 |
19 |
Chainguard Nginx Image
20 |
21 |
22 |
CVEs
23 |

0

24 |
25 |
26 |
Size
27 |

8.7MB

28 |
29 |
30 |
Age
31 |

32 |
33 |
34 |
35 |
Upstream Nginx
36 |
37 |
38 |
39 |
40 |
41 |
CVEs
42 |
43 |
44 |
Size
45 |
46 |
47 |
Age
48 |
49 |
50 |
51 |
52 |

135

53 |
54 |
55 |

70MB

56 |
57 |
58 |

59 |
60 |
61 |
62 |
63 |
64 | Generated from opensource dataset 65 |
66 |
67 | 68 | 69 | -------------------------------------------------------------------------------- /comparison-php.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Chainguard Image Comparison | PHP 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 |
19 |
Chainguard PHP Image
20 |
21 |
22 |
CVEs
23 |

0

24 |
25 |
26 |
Size
27 |

31MB

28 |
29 |
30 |
Age
31 |

32 |
33 |
34 |
35 |
Upstream PHP
36 |
37 |
38 |
39 |
40 |
41 |
CVEs
42 |
43 |
44 |
Size
45 |
46 |
47 |
Age
48 |
49 |
50 |
51 |
52 |

331

53 |
54 |
55 |

179MB

56 |
57 |
58 |

59 |
60 |
61 |
62 |
63 |
64 | Generated from opensource dataset 65 |
66 |
67 | 68 | 69 | -------------------------------------------------------------------------------- /comparison.css: -------------------------------------------------------------------------------- 1 | .brands__wrapper::-webkit-scrollbar, .mob-scroll::-webkit-scrollbar {display: none;} 2 | .brands__wrapper, .mob-scroll {-ms-overflow-style: none;scrollbar-width: none;} 3 | .primary-dd:last-child {border: none;} 4 | .error {font-size: 12px;margin-top: 8px;color: #B81E22;line-height: 14px;font-weight: 400;} 5 | .primary-input.error {margin-top: 0px;background-color: #FFEDE9;border: 1px solid #B81E22;} 6 | .primary-input.error:focus {box-shadow: 0 0 0 2px #B81E22;} 7 | input[aria-invalid="true"]::placeholder {color: #B81E22;} 8 | section .template-wrapper.mt-64 .rich-text.w-richtext { max-width: 750px !important; } 9 | blockquote p { margin-bottom: 0 !important; margin-top: 0 !important;} 10 | blockquote ul.post-content { margin-bottom: 0 } 11 | .rich-text blockquote {font-style: italic;} 12 | p > code, 13 | blockquote code{white-space: pre-wrap;font-size: 0.75em;padding: 4px 8px;background: #25252a;border: 1px solid #4a4b4e;color: #e3e3e6;} 14 | .post-content { margin: 0 0 4rem;padding-left: 2em; } 15 | .post-content > :first-child {margin-top: 0;} 16 | .post-content li::marker { color: transparent;} 17 | .post-content > li::before,.post-content ul li::before { margin-top: -4px; content: '—' !important; position: absolute; width: 1.5em; margin-left: -1.9em; font-size: 1em; font-weight: 500; line-height: 2em; text-align: right; color: #454CE4; } 18 | .post-content ul {padding-left: 30px; margin: 15px 0;} 19 | .kg-embed-card {margin: 0 0 4rem;min-width: 100%;max-width: 100%;} 20 | .kg-embed-card .fluid-width-video-wrapper { padding-top: 56.5%;margin: 0 0 4rem;width: 100%; position: relative;} 21 | .kg-embed-card .fluid-width-video-wrapper iframe {position: absolute;top: 0;left: 0;width: 100%;height: 100%;} 22 | figcaption {position: relative;color: #222426;max-width: calc(64rem + 8vw);margin: unset;float: left;font-size: 0.75em;line-height: 2em;padding: 1rem 0;} 23 | figcaption::after {content: '';position: absolute;left: 0;bottom: 0;width: 8rem;height: 1px;background-color: #3B3D40;} 24 | figure.kg-card.kg-image-card {min-width: 100%} 25 | ul.post-content {margin-bottom: 0;} 26 | .kg-card.kg-button-card.kg-align-center{width: 100%;justify-content: center;display: flex;position: static;align-items: center;} 27 | .kg-card.kg-button-card.kg-align-center a {background-color: #3F46C7;color: #fff;padding: 10px 1.2em;height: 2.4em;line-height: 1em;font-family: -apple-system,BlinkMacSystemFont,"Segoe UI","Roboto","Oxygen","Ubuntu","Cantarell","Fira Sans","Droid Sans","Helvetica Neue",sans-serif;font-size: .95em;font-weight: 600;text-decoration: none;border-radius: 5px;transition: opacity .2s ease-in-out; } 28 | .kg-card.kg-button-card.kg-align-center a:hover {opacity: .85;} 29 | .kg-card.kg-callout-card.kg-callout-card-grey {background: rgba(124,139,154,.13);display: flex;padding: 1.2em 1.6em;border-radius: 3px;} 30 | .kg-card.kg-callout-card.kg-callout-card-grey div.kg-callout-text {font-size: .95em;line-height: 1.5em;} 31 | .kg-card.kg-gallery-card.kg-width-wide {margin: 0 0 4rem;margin-bottom: 4rem; min-width: 100%;} 32 | .kg-card.kg-gallery-card.kg-width-wide .kg-gallery-container {display: flex; flex-direction: column;} 33 | .kg-card.kg-gallery-card.kg-width-wide .kg-gallery-row {display: flex;flex-direction: row;justify-content: center;} 34 | .kg-card.kg-gallery-card.kg-width-wide .kg-gallery-row .kg-gallery-image {flex: 1.33333 1 0%;} 35 | .kg-card.kg-gallery-card.kg-width-wide .kg-gallery-image img {display: block;margin: 0;width: 100%;height: 100%;} 36 | .tb-post { border: 1px solid #3B3D40; } 37 | .tb-post th, .tb-post td {border: 1px solid #3B3D40;padding: 1.5rem;} 38 | @media(max-width: 1199px) { 39 | section .template-wrapper.mt-64 .rich-text.w-richtext { max-width: calc(100Vw - 11.5%) !important; } 40 | } 41 | @media(max-width: 991px) { 42 | section .template-wrapper.mt-64 .rich-text.w-richtext { max-width: calc(100Vw - 9.5%) !important; } 43 | } 44 | img {user-drag: none;user-select: none;-moz-user-select: none;-webkit-user-drag: none;-webkit-user-select: none;-ms-user-select: none;} 45 | .header.active {background-color: #FFFFFF !important;} 46 | .header__dd-toggle.w-dropdown-toggle.active {color: black !important;} 47 | .header__dd-toggle.w-dropdown-toggle.active > a {color: black !important;} 48 | .header__dd-toggle.w-dropdown-toggle:hover {color: #454CE4 !important;} 49 | .header__dd-toggle.link.active {color: rgb(0, 0, 0) !important;} 50 | .header__dd-toggle.link.active:hover {color: rgb(0, 0, 0) !important;} 51 | .header.active .btn {border-color:#454CE4 !important;} 52 | .header .btn.trans-no-border {border-color: transparent !important;} 53 | .header.active .btn.trans-no-border {color:#454CE4 !important;background: transparent !important;border-color: transparent !important;} 54 | .header.active .btn.sticky {color:#fff !important;background: #454ce4 !important;border-color: #454ce4!important;} 55 | .header.active .btn.sticky:hover {background: #282ecd !important;} 56 | .header.active .btn.trans {color: #454CE4 !important} 57 | .header.active .btn.trans:hover {opacity: 1; background: #f1effe !important; color: #454ce4 !important} 58 | .header.active .header__logo-1 {display: none !important;} 59 | .header.active .header__logo-2 {display: block !important;} 60 | .header.active .header__nav-burger {background-color: #454CE4 !important;} 61 | .btn.btn--secondary[disabled] {background-color: #E0E1FE;color: #8087FC;border-color:#E0E1FE;} 62 | .featured-articles-slider.leadership .w-slide.open-popup { transform: none !important;transition:none !important;} 63 | .w-slider-mask.open-popup { z-index: 2000;} 64 | .rich-text.unc-detail p { 65 | font-size: 18px; 66 | } 67 | @media screen and (max-width: 768px) { 68 | .header__links {min-height: -webkit-fill-available;height: calc(var(--vh, 1vh) * 100);} 69 | .rich-text.unc-detail p { 70 | font-size: 16px; 71 | } 72 | 73 | } 74 | 75 | @media screen and (max-width: 395px) { 76 | h2 { 77 | font-size: 24px !important; 78 | } 79 | .text-title-1.is-small { 80 | font-size: 12px; 81 | } 82 | .text-body-02 { 83 | font-size: 12px; 84 | } 85 | } 86 | 87 | .logo-flex, .overflow-scroll-wrap { 88 | -ms-overflow-style: none; 89 | scrollbar-width: none; 90 | } 91 | .logo-flex::-webkit-scrollbar, .overflow-scroll-wrap::-webkit-scrollbar { 92 | display: none; 93 | } 94 | .hero-image-wrap { 95 | filter: drop-shadow(0px 8px 32px rgba(69, 76, 228, 0.12)); 96 | } 97 | -------------------------------------------------------------------------------- /comparison.template.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Chainguard Image Comparison | {{imageName}} 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 |
19 |
Chainguard {{imageName}} Image
20 |
21 |
22 |
CVEs
23 |

{{oursCvesNum}}

24 |
25 |
26 |
Size
27 |

{{oursSizeNum}}{{oursSizeUnit}}

28 |
29 |
30 |
Age
31 |

32 |
33 |
34 |
35 |
Upstream {{imageName}}
36 |
37 |
38 |
39 |
40 |
41 |
CVEs
42 |
43 |
44 |
Size
45 |
46 |
47 |
Age
48 |
49 |
50 |
51 |
52 |

{{theirsCvesNum}}

53 |
54 |
55 |

{{theirsSizeNum}}{{theirsSizeUnit}}

56 |
57 |
58 |

59 |
60 |
61 |
62 |
63 |
64 | Generated from opensource dataset 65 |
66 |
67 | 68 | 69 | -------------------------------------------------------------------------------- /gen-html.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # A simple script that reads from rumble data, gets extra info 4 | # about the latest scanned image (size and build time), then 5 | # uses this data to create the image-comparison-*.html files 6 | 7 | set -ex 8 | 9 | function epoch { 10 | ts="$(echo "${1}" | cut -d. -f1 | sed 's|Z||')" 11 | python3 -c "import os; os.environ['TZ'] = 'UTC'; from datetime import datetime as dt; t = dt.strptime('${ts}', '%Y-%m-%dT%H:%M:%S'); print(int((t - dt(1970, 1, 1)).total_seconds() * 1000))" 12 | } 13 | 14 | function epoch_now { 15 | python3 -c "import os; os.environ['TZ'] = 'UTC'; from datetime import datetime as dt; t = dt.now(); print(int((t - dt(1970, 1, 1)).total_seconds() * 1000))" 16 | } 17 | 18 | # Inspired by https://gist.github.com/imjasonh/ce437a40160acab17030d024d4680fd2 19 | function image_size { 20 | size="$(crane manifest $1 --platform ${2:-linux/amd64} | jq '.config.size + ([.layers[].size] | add)' | numfmt --to=iec)" 21 | echo "${size}" | sed 's|K| KB|' | sed 's|M| MB|' | sed 's|G| GB|' | sed 's|T| TB|' 22 | } 23 | 24 | function num_cves { 25 | docker run --rm cgr.dev/chainguard/grype $1 -o json 2>/dev/null | jq '.matches | length' 26 | } 27 | 28 | function main { 29 | for combo in \ 30 | "go|Go|cgr.dev/chainguard/go:latest|golang:latest" \ 31 | "nginx|Nginx|cgr.dev/chainguard/nginx:latest|nginx:latest" \ 32 | "php|PHP|cgr.dev/chainguard/php:latest|php:latest"; do 33 | 34 | image_key="$(echo "${combo}" | cut -d\| -f1)" 35 | image_name="$(echo "${combo}" | cut -d\| -f2)" 36 | 37 | ours_ref="$(echo "${combo}" | cut -d\| -f3)" 38 | ours_cves_num="$(num_cves "${ours_ref}")" 39 | 40 | theirs_ref="$(echo "${combo}" | cut -d\| -f4)" 41 | theirs_cves_num="$(num_cves "${theirs_ref}")" 42 | 43 | ours_size="$(image_size "${ours_ref}")" 44 | 45 | # The "created" field in the image config now represents the 46 | # last time a package in the image was updated. Instead of looking at this 47 | # field to determine the last time the image was rebuilt, check the latest signature. 48 | # For more info, see https://www.chainguard.dev/unchained/designing-build-date-epoch-in-chainguard-images 49 | #ours_crane_resp="$(crane config "${ours_ref}")" 50 | #ours_timestamp="$(epoch "$(echo "${ours_crane_resp}" | jq -r '.created')")" 51 | ours_timestamp="$(epoch "$(cosign download signature "${ours_ref}" | tail -n1 | jq -r .Cert.NotBefore)")" 52 | 53 | theirs_size="$(image_size "${theirs_ref}")" 54 | theirs_crane_resp="$(crane config "${theirs_ref}")" 55 | theirs_timestamp="$(epoch "$(echo "${theirs_crane_resp}" | jq -r '.created')")" 56 | 57 | ours_size_num="$(echo "${ours_size}" | awk '{print $1}')" 58 | ours_size_unit="$(echo "${ours_size}" | awk '{print $2}')" 59 | theirs_size_num="$(echo "${theirs_size}" | awk '{print $1}')" 60 | theirs_size_unit="$(echo "${theirs_size}" | awk '{print $2}')" 61 | 62 | generated_at_timestamp="$(epoch_now)" 63 | 64 | cat comparison.template.html | \ 65 | sed "s|{{imageName}}|${image_name}|g" | \ 66 | sed "s|{{oursCvesNum}}|${ours_cves_num}|g" | \ 67 | sed "s|{{oursSizeNum}}|${ours_size_num}|g" | \ 68 | sed "s|{{oursSizeUnit}}|${ours_size_unit}|g" | \ 69 | sed "s|{{oursTimestamp}}|${ours_timestamp}|g" | \ 70 | sed "s|{{theirsCvesNum}}|${theirs_cves_num}|g" | \ 71 | sed "s|{{theirsSizeNum}}|${theirs_size_num}|g" | \ 72 | sed "s|{{theirsSizeUnit}}|${theirs_size_unit}|g" | \ 73 | sed "s|{{theirsTimestamp}}|${theirs_timestamp}|g" | \ 74 | sed "s|{{generatedAtTimestamp}}|${generated_at_timestamp}|g" > \ 75 | "comparison-${image_key}.html" 76 | done 77 | } 78 | 79 | main 80 | --------------------------------------------------------------------------------