The State of Trusted Open Source

Chainguard, described as the trusted source for open source, reveals that their catalog spans over 1800 container image projects, 148,000 versions, 290,000 images and 100,000 language libraries, with almost half a billion builds observed across a growing customer base. The State of Trusted Open Source notes that AI is reshaping the baseline stack, with Python leading the most popular open source image across Chainguard’s global customers.

It also finds that more than half of production runs occur outside the top 20 most popular images, meaning the longtail images are a core part of real-world infrastructure. Notably, 98% of the vulnerabilities Chainguard remediated in the past three months occurred outside the top 20 images, while 214 CVEs happened in the top 20, representing 2% of total CVEs.

Compliance drives action, with 44% of customers running at least one FIPS image in production, and top FIPS images including Python-fips, Node-fips, nginx-fips, and others. Chainguard reports rapid remediation for Critical CVEs, averaging under 20 hours, and a pattern showing the longtail bears the bulk of security and compliance risk.