Skip to content

Commit 6aa499e

Browse files
committed
Clarify package policy details
1 parent cfcbc21 commit 6aa499e

1 file changed

Lines changed: 26 additions & 3 deletions

File tree

profile/README.md

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,20 +14,22 @@ Wolfi, whose name was inspired by the [world's smallest octopus](https://en.wiki
1414

1515
- Provides a high-quality, build-time SBOM as standard for all packages
1616
- Packages are designed to be granular and independent, to support minimal images
17+
- Focuses on the latest release of all packages
1718
- Uses the proven and reliable apk package format
1819
- Fully declarative and reproducible build system
1920
- Designed to support glibc
2021

2122
## Where's the Source?
2223

23-
* [os](https://github.com/wolfi-dev/os) contains the core Wolfi OS repository.
24+
The [os repository](https://github.com/wolfi-dev/os) contains the core Wolfi OS as a sync from internal Chainguard repositories. Any proposed improvements are applied internally, and then synced back out to the public repository.
2425

2526
## Wolfi Community
2627

2728
| Resource | Details |
2829
| ----------- | ----------- |
2930
| Forum | See [GitHub Discussions](https://github.com/orgs/wolfi-dev/discussions) |
3031
| Slack | Some community members can be found in the`#apko` channel on [Kubernetes Slack](https://slack.kubernetes.io), but there is no active monitoring of this channel.|
32+
| Slack | Some community members can be found on [Chainguard Community Slack](https://join.slack.com/t/chainguardcommunity/shared_invite/zt-3nxzg5zz7-_7r3CdZ01M17ICCuNMhwtA)|
3133

3234
The [community repo](https://github.com/wolfi-dev/community) contains full details of past community calls and resources.
3335

@@ -81,30 +83,51 @@ For more guidance, you can check out a full tutorial on [Creating Wolfi Images w
8183
## FAQ
8284

8385
### What is Wolfi and how does it compare to Alpine?
86+
8487
Wolfi is a Linux _undistro_ designed from the ground up to support newer computing paradigms such as containers. Although Wolfi has a few similar design principles as Alpine (such as using apk), it is a different distribution that is focused on supply chain security. Unlike Alpine, Wolfi does not currently build its own Linux kernel, instead relying on the host environment (e.g. a container runtime) to provide one.
8588

8689
### Is Wolfi free to use?
90+
8791
Yes, Wolfi is freely [available under the Apache License V2](https://github.com/wolfi-dev/os/blob/main/LICENSE) and will always be.
8892

8993
### Where are packages in Wolfi published?
94+
9095
Packages in Wolfi are published to [public Wolfi APK Repositories](https://edu.chainguard.dev/chainguard/chainguard-images/network-requirements/).
9196

92-
Non-latest versions of packages in these repositories are retained for 12 months by default. For more information, see the [Wolfi Archive Policy announcement](https://github.com/orgs/wolfi-dev/discussions/63023).
97+
### What packages are included in Wolfi?
98+
99+
Wolfi focusses on latest package versions and provides a base minimum of packages for variety of containers. Specifically all packages used in free Chainguard Containers are available as packages.
100+
101+
Non-latest versions of packages in these repositories are retained for 12 months until June 8th, 2026, and then for 6 months by default.
102+
103+
For more information, see the [Wolfi Archive Policy announcement](https://github.com/orgs/wolfi-dev/discussions/63023), the [updated policy announcement](](https://github.com/orgs/wolfi-dev/discussions/78666)), and our [discussions forum in general](https://github.com/orgs/wolfi-dev/discussions).
104+
105+
Chainguard also regularly removes packages from Wolfi for reasons outside the scope of the Wolfi retention policy. Typically, this involves removing the package definition from the Wolfi GitHub repository only.
106+
107+
Existing packages that have already been built remain in the Wolfi binary package repository such as `apk.cgr.dev/chainguard/x86_64` until they are removed according to the retention policy.
108+
109+
The most common trigger for removal is when a new version of a version streamed package is released. In this situation, package definitions for prior versions streams are removed from Wolfi. For example, when MariaDB 13 is released and added to Wolfi, MariaDB 12 is removed from Wolfi. New versions of MariaDB 12 packages are available from Chainguard only as the focus of Wolfi is on latest releases only.
110+
111+
### Can I mix packages from Alpine repositories into a Wolfi-based image?
93112

94-
### Can I mix packages from Alpine repositories into a Wolfi-based image?
95113
No, it’s not possible to mix Alpine apks with Wolfi apks. If your image requires dependencies that are currently only available for Alpine. You might consider using [melange](https://github.com/chainguard-dev/melange) to build a custom apk for your image.
96114

97115
### Can I use Wolfi on the Desktop?
116+
98117
No. Desktop distributions require additional software that is out of scope for Wolfi.
99118

100119
### Who maintains Wolfi?
120+
101121
Wolfi was created and is currently maintained by [Chainguard](https://chainguard.dev) as the base of Chainguard OS.
102122

103123
### What are the plans for long-term Wolfi governance?
124+
104125
We intend for Wolfi to be the core foundation of Chainguard OS and available as open source project for use with minimal packages as used in our free Chainguard Containers.
105126

106127
### Where can I get security feeds for Wolfi?
128+
107129
See [SECURITY.md](/SECURITY.md) for information about reporting security incidents concerning and consuming security data about Wolfi.
108130

109131
### Where can I ask questions or learn more about using Wolfi?
132+
110133
Find details in our [repositories](https://github.com/orgs/wolfi-dev/repositories), use our [community channels](#wolfi-community) and read our [documentation](https://edu.chainguard.dev/open-source/wolfi/overview/).

0 commit comments

Comments
 (0)