SecureBuild
Web and SaaS
container images for software vendors
SHOW HN2025
How HN took it
1 positive, 8 neutral or asking, 0 mixed, 2 critical, out of 11 comments about the project. Thread score -0.11.
Execution: 1 for, 1 againstIdea: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Revenue sharing model addresses maintainer funding problem
From 1 comment
this looks cool - your homepage video should open with what it is though!
dhorthy on HN
Objections
CVE-speed focus misses what matters; prioritize actively exploited vulnerabilities
From 2 comments
> I've seen most auditors mandate 30 days for Critical, but you clearly want to move a lot quicker than that. You seem to fundamentally not understand security. A proper security…
mike_d on HNIt can be true for you if your correct your thinking on the problem. CVEs are basically just bugs that are not triggered by normal operation. If you race to "fix" them all, you…
mike_d on HN
Criticism that the 6-day critical SLA is unusually aggressive versus the 48-hour norm
From 1 comment
> New SecureBuilds are created whenever upstream CVEs are available, with a 6-day SLA for critical vulnerabilities. Aren't most SecOps pushing 48 hours as the absolute limit for…
cube00 on HN
Homepage messaging unclear about what the product does
From 2 comments
this looks cool - your homepage video should open with what it is though!
dhorthy on HNMore about what you actually do -- I'd suggest something like "Secure, Sustainable Open Source: We partner with open source projects to monitor their upstream dependencies for…
justinludwig on HN
Requests
Clearer homepage copy describing what the service does
From 2 comments
this looks cool - your homepage video should open with what it is though!
dhorthy on HNMore about what you actually do -- I'd suggest something like "Secure, Sustainable Open Source: We partner with open source projects to monitor their upstream dependencies for…
justinludwig on HN
Correct the wording: new builds are cut for upstream CVE fixes, not CVEs
From 1 comment
More about what you actually do -- I'd suggest something like "Secure, Sustainable Open Source: We partner with open source projects to monitor their upstream dependencies for…
justinludwig on HN
Questions
What is the process to add new images and how are they tested
From 2 comments
What's the process to add new images? I assume this is limited to CVEs in the underlying layers, and adding in the latest of the primary package. Given that how/are you testing…
westwater on HNAdding images involves us creating a new package (APK) in our APK repo. This is done by creating a melange build config (https://github.com/chainguard-dev/melange). The melange…
marcc on HN
What is the onboarding process for maintainers with existing Dockerfiles
From 2 comments
thanks for sharing. what's the onboarding process look like? if i'm maintaining my own Dockerfiles today, do you or I evaluate and port those to SecureBuild/Wolfi?
siggy on HNWe work together on it. Assuming you have a build process and dockerfile (we all do), generally our team can get you listed in the catalog quickly. It's not too much work since…
marcc on HN
How does this compare with IronBank
From 1 comment
How does this compare with something like IronBank? Looks like that could be a great partnership!
sheepybloke on HN
Alternatives named
IronBank
From 1 comment
How does this compare with something like IronBank? Looks like that could be a great partnership!
sheepybloke on HN
Chainguard images
From 1 comment
Adding images involves us creating a new package (APK) in our APK repo. This is done by creating a melange build config (https://github.com/chainguard-dev/melange). The melange…
marcc on HN