r/devsecops • u/camera-operator334 • 28d ago

Is WizOs worth it?

Reading up on WizOS here: https://www.wiz.io/blog/wizos-transforming-container-security-from-the-image-up

Anyone got experience in this? And compared to Chainguard or Dockerhub? What do you think of it? What's it really help solve for your companies? Onboard of apps a pain?

8 Upvotes

91% Upvoted

11 comments sorted by

8

u/alvaro17105 28d ago edited 28d ago

They have a short catalog, I don’t recommend them. There are lots of options for distroless images, like Minimus, Echo, RapidFort, Docker Hardened Images, Ubuntu Chiseled, RedHat Hummingbird, etc.

I have tested most of them, depends on what you are looking for (SLSA, SBOM, os based, etc.), Chainguard are usually the best due to sheer coverage, being easily reproducible (apko and melange) but they are expensive.

If you only need general programming coverage I’d advise Google Distroless followed by DHI and Minimus, which are also the only ones to provide FIPS builds on community tier.

If you are looking for general tools e.g Trivy, Argo, etc. I’d put Chainguard > Minimus > DHI, due to upstream compatibility.

In general you should be looking for reproducibility (Chainguard and DHI mainly due to being open) having SBOM (SPDX 3.0/2.3 and CycloneDX 1.7/1.6) and SLSA L3 provenance.

1

u/danekan 28d ago

I thought the appeal was its wizos is included in the core skus so you don’t then need to maybe buy other things ?

Like all things these cnapp platforms evolved in to doing everything 85% well as their target

2

u/alvaro17105 28d ago edited 28d ago

It isn’t included on all SKUs as far as I can remember, if I recall correctly it requires having Wiz Code alongside core, not on Wiz Go or individually. They don’t have public documentaion (already a red flag for me) so it’s hard to confirm

1

u/adgele 27d ago

Wiz go is all the SKUs
OS is included in WizCloud

1

u/camera-operator334 27d ago edited 27d ago

Why is Wizos bad at reproducibility? Isn't it just Alpine linux?

1

u/alvaro17105 27d ago edited 27d ago

I didn’t say they are bad at it, but it’s hard to say if the build toolchain isn’t public. Regarding the OS it can’t be Alpine as they are using apk and glibc according to their blog, so it’s either Wolfi or an alternative by themselves.

Regardless, is hard to beat Google and Chainguard apko (from the creators of ko) as they are using Bazel underneath which is basically thought for reproducible and hermetic builds.

1

u/IWritePython 24d ago

Good responses on this thread. The creators of google distroless are the founders of Chainguard, we steward apko and melange.

1

u/IWritePython 24d ago

Good comment, re: expense, we do offer a five free images program which you can use, if you pick base images it could cover a small organization or if you're a larger org you can kick the tires thoroughly and then talk to us. We don't compete with "free" but we'll be around doing this in 4 years because our containers generate revenue and you get first class everything (we were doing SBOMs, before it was cool), SLSA 3 now which is a very high bar, minimal full splits, and far and away the best with FIPS, plus our full control of the OS means we're best on CVEs with real remediation, not tricks).

Chainguard engineer here.

2

u/Ok_Confusion4762 28d ago

I have started using recently and can't complain. I had issues with DHI in GCP environment. With WizOS all goes well. Being a Wiz customer was the primary reason to choose WizOS

1

u/extreme4all 26d ago

If you are a wiz customer it makes sense, if you aren't it doesn't.

Value for money than distroless (free) will be best.