Cut Bloat, Not Features
Ubuntu, Friday, September 11th, 2026
Chisel-built minimal OCI images keep package metadata so CVE scanning still works after trimming.
Canonical previews a technical webinar on building lightweight, secure container images using rocks, its OCI-compliant minimal images.
The engineering point is that rocks use a bottom-up approach with the Chisel package manager, which retains package metadata so CVE scanners can still identify what is present.
That distinguishes the approach from distroless images, where aggressive trimming often destroys the metadata scanners depend on, producing a clean scan result that reflects missing information rather than absent vulnerabilities. Enterprise commitments include non-root execution and up to fifteen years of LTS support.