What It Took to Reach 1 Billion Build Manifests

Chainguard has doubled its container build manifest output from 500 million to over 1 billion in just six months, a significant leap enabled by its Chainguard Factory infrastructure. This growth is a direct result of a new, self-correcting build system called DriftlessAF, which proactively addresses vulnerabilities and maintains a continuous, secure update cycle. The system operates by continuously comparing a desired state against the actual state, and actively working to close any gaps – whether triggered by a newly reported CVE, an upstream package version update, or a new best practice implementation.

At the heart of this transformation is the concept of a ‘build manifest’ – representing every time Chainguard Factory produces a new, verifiable artifact, such as a fresh image for go:1.26.5, a rebuild of nginx triggered by a libc patch, or a new architecture variant. The sheer volume of these artifacts – and the need to keep them consistently secure – necessitated a fundamental rethinking of the build process.

Previously, Chainguard Factory operated as a traditional event-driven system, struggling to cope with the increasing complexity and volume of changes. The system devolved into a ‘cascading mess,’ with SREs overwhelmed by event notifications and a growing number of duplicate build failures. However, DriftlessAF tackles these issues head-on through a layered approach.

Key components of DriftlessAF include a reconciliation loop, a continuous work queue, and AI-powered decision-making. The reconciliation loop constantly monitors for discrepancies and works to correct them, while the continuous work queue distributes tasks to a large number of ‘reconciler bots.’ These bots use AI to handle complex judgment calls – such as reasoning about a newly added component in a minor release or backporting a CVE remediation to an older package and language release – all while operating through highly structured, verifiable tools to prevent hallucination and ensure a reliable outcome. Over time, the system learns from prior successes, informing future patches and reducing the need for manual intervention.

This shift to DriftlessAF allows Chainguard’s engineering team to focus on improving the factory infrastructure, the quality of the outputs (including Chainguard Libraries, Chainguard Agent Skills, and Chainguard Actions), and the overall scope of what Chainguard Factory builds and maintains. The rapid rebuild speed is critical in a world where attackers are increasingly leveraging AI to accelerate their attack cycles – demanding a similarly accelerated response from defenders.

To explore the current state of the catalog and delve into the DriftlessAF system itself, you can visit Chainguard’s container image catalog and explore the DriftlessAF documentation and resources.