State of the Art of Container Security • Adrian Mouat & Charles Humble • GOTO 2026

This interview was recorded for GOTO State of the Art in November 2025. #GOTOcon #GOTO
https://gotopia.tech

Read the full transcription of this interview here:
https://gotopia.tech/articles/425

Adrian Mouat - Developer Relations at Chainguard & Author of 'Using Docker' @AdrianMouat 
Charles Humble - Freelance Techie, Podcaster, Editor, Author & Consultant

RESOURCES
Adrian
https://bsky.app/profile/adrianmouat.com
https://twitter.com/adrianmouat
https://github.com/amouat
https://linkedin.com/in/adrianmouat
http://www.adrianmouat.com

Charles
https://bsky.app/profile/charleshumble.bsky.social
https://linkedin.com/in/charleshumble
https://mastodon.social/@charleshumble
https://conissaunce.com

Links
https://images.chainguard.dev
https://www.cisa.gov/sbom
https://www.chainguard.dev/supply-chain-security-101/the-npm-registry-cant-protect-you-the-new-javascript-supply-chain-attacks
https://oxide-and-friends.transistor.fm/episodes/discovering-the-xz-backdoor-with-andres-freund
https://edu.chainguard.dev
https://youtu.be/A32Yjizt2_s
https://youtu.be/8fi7uSYlOdc
https://youtu.be/teLsZFZZ1Z0
https://youtu.be/iD3HQ0LXM_M
https://youtu.be/bZTlLAg9UZ4
https://youtu.be/bAgCyR0EkTY
https://youtu.be/DJV9vMQpRI0
https://youtu.be/5zY5_iTGIsU
https://youtu.be/NNMnbBf0Itw
https://youtu.be/qWKf3ROVgrY
https://youtu.be/5O1djJ13gRU
https://youtu.be/ag2ykPO805M
https://youtu.be/ZrGOv44iTC8
https://youtu.be/Cx_vijTm24w
https://youtu.be/4HMRFcg6nEY
https://youtu.be/EGSMP2UodKM

DESCRIPTION
In this State of the Art episode, Charles Humble speaks with Adrian Mouat, Developer Relations at Chainguard and author of "Using Docker", about the evolution of container security and the persistent challenge of outdated packages.

Adrian explains how traditional Linux distributions weren't designed for the immutable, frequently-replaced nature of containers, leading to security vulnerabilities that scanners detect but teams struggle to address. He discusses how Chainguard tackles this problem by building everything from source using Wolfi, creating minimal "distroless" images with near-zero CVEs, and how concepts like SBOMs, attestations, and defense in depth are reshaping security practices.

The conversation also covers major security incidents including the XZ Utils backdoor and Shai-hulud attacks, emphasizing the importance of building from source, using short-lived credentials, and replacing rather than updating containers – practices pioneered by companies like Google that are gradually spreading across the industry.

TIMECODES
00:00 Intro
01:02 Early adoption of containers
02:12 The problem of outdated packages
05:21 Understanding scanners & vulnerabilities
09:39 Google Distroless & the beginning of Chainguard
14:39 Wolfi & building from source
20:14 Software Bill of Materials (SBOM) & attestations
27:01 Defense in depth & best practices
34:32 The XZ utils backdoor
38:14 Resources
38:52 Outro

RECOMMENDED BOOKS
Adrian Mouat • Using Docker • https://amzn.to/3PEYIJL
Liz Rice • Container Security • https://amzn.to/3oU4iJe
Liz Rice • Kubernetes Security • https://www.oreilly.com/library/view/kubernetes-security/9781492039075

https://bsky.app/profile/gotocon.com
https://twitter.com/GOTOcon
https://www.linkedin.com/company/goto-
https://www.instagram.com/goto_con
https://www.facebook.com/GOTOConferences
#Chainguard #Cybersecurity #Security #Wolfi #GoogleDistroless #SBOM #SoftwareBillOfMaterials #XZutils #ShaiHulud #ShaiHuludAttack #Containers #ContainerSecurity #Docker #DockerSecurity #TodaInTech #AdrianMouat #CharlesHumble

CHANNEL MEMBERSHIP BONUS
Join this channel to get early access to videos & other perks:
https://www.youtube.com/channel/UCs_tLP3AiwYKwdUHpltJPuA/join

Looking for a unique learning experience?
Attend the next GOTO conference near you! Get your ticket at https://gotopia.tech
Sign up for updates and specials at https://gotopia.tech/newsletter

SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily.
https://www.youtube.com/user/GotoConferences/?sub_confirmation=1