Chainguard, the trusted supply for open supply, has a novel view into how fashionable organizations truly eat open supply software program and the place they run into danger and operational burdens. Throughout a rising buyer base and an intensive catalog of over 1800 container picture initiatives, 148,000 variations, 290,000 photographs, and 100,000 language libraries, and nearly half a billion builds, they’ll see what groups pull, deploy, and keep day-to-day, together with the vulnerabilities and remediation realities that come hand in hand.
That is why they created The State of Trusted Open Supply, a quarterly pulse on the open supply software program provide chain. As they analyzed anonymized product utilization and CVE information, the Chainguard group seen frequent themes round what open supply engineering groups are literally constructing with and the dangers related.
This is what they discovered:
- AI is reshaping the baseline stack: Python led the way in which as the most well-liked open supply picture amongst Chainguard’s international buyer base, powering the trendy AI stack.
- Over half of manufacturing occurs outdoors of the most well-liked initiatives: Most groups might standardize on a well-recognized set of photographs, however real-world infrastructure is powered by a broad portfolio that extends far past the highest 20 hottest, which they discuss with on this report as longtail photographs.
- Recognition does not map to danger: 98% of the vulnerabilities discovered and remediated in Chainguard photographs occurred outdoors of the highest 20 hottest initiatives. Meaning the most important security burden accumulates within the less-visible a part of the stack, the place patching is hardest to operationalize.
- Compliance might be the catalyst for motion: Compliance takes many types in the present day: from SBOM and vulnerability necessities to business frameworks like PCI DSS, SOC 2, and rules just like the EU’s Cyber Resilience Act. FIPS is only one instance, targeted particularly on U.S. federal encryption requirements. Even so, 44% of Chainguard prospects run a FIPS picture in manufacturing, underscoring how incessantly regulatory wants form real-world software program choices.
- Belief is constructed on remediation pace: Chainguard eradicated Important CVEs, on common, in beneath 20 hours.
Earlier than we dive in, a observe on the methodology: This report analyzes 1800+ distinctive container picture initiatives, 10,100 complete vulnerability cases, and 154 distinctive CVEs tracked from September 1, 2025, by November 30, 2025. After we use phrases like “high 20 initiatives” and “longtail initiatives” (as outlined by photographs outdoors of the highest 20), we’re referring to actual utilization patterns noticed throughout Chainguard’s buyer portfolio and in manufacturing pulls.
Utilization: What groups truly run in manufacturing
If you happen to zoom out, in the present day’s manufacturing container footprint seems precisely such as you’d count on: foundational languages, runtimes, and infrastructure elements dominate the most well-liked checklist.
Hottest photographs: AI is reshaping the baseline stack
Throughout all areas, the highest photographs are acquainted staples: Python (71.7% of consumers), Node (56.5%), nginx (40.1%), go (33.5%), redis (31.4%), adopted by JDK, JRE, and a cluster of core observability and platform tooling like Grafana, Prometheus, Istio, cert-manager, argocd, ingress-nginx, and kube-state-metrics.
This means that prospects function a portfolio of important constructing blocks – together with languages, gateways, service mesh, monitoring, and controllers – that collectively type the inspiration of their enterprise.
It is not stunning to see Python main the way in which globally, because the default glue language for the trendy AI stack. Groups usually standardize on Python for mannequin growth, information pipelines, and more and more for manufacturing inference providers as effectively.
Hottest by area: Comparable foundations, totally different longtail combine
North America exhibits a broad and constant set of default manufacturing constructing blocks: Python (71.7% of consumers), Node (56.6%), nginx (39.8%), go (31.9%), redis (31.5%), plus sturdy penetration of Kubernetes ecosystem elements (cert-manager, istio, argocd, prometheus, kube-state-metrics, node-exporter, kubectl). Notably, even utility photographs like busybox present up meaningfully.
Outdoors North America, the identical core stack seems, however the portfolio spreads in a different way: Python (72% of consumers), Node (55.8%), Go (44.2%), nginx (41.9%), and a noticeable presence of .NET runtimes (aspnet-runtime, dotnet-runtime, dotnet-sdk) and PostgreSQL.
The longtail of photographs is essential to manufacturing, not edge instances
Chainguard’s hottest photographs symbolize only one.37% of all out there photographs and account for roughly half of all container pulls. The opposite half of manufacturing utilization comes from in all places else: 1,436 longtail photographs that make up 61.42% of the typical buyer’s container portfolio.
In different phrases, half of all manufacturing workloads run on longtail photographs. These aren’t edge instances. They’re core to Chainguard’s prospects’ infrastructure. It is comparatively simple to maintain the highest handful of photographs polished, however what trusted open supply requires is sustaining that security and velocity throughout the breadth of what prospects truly run.
FIPS utilization: Compliance is a catalyst for motion
FIPS encryption is a vital know-how within the compliance panorama, targeted on satisfying U.S. federal encryption necessities. And it presents a helpful window into how regulatory stress drives adoption. Within the information, 44% of consumers run not less than one FIPS picture in manufacturing.
The sample is constant: when working inside compliance frameworks like FedRAMP, DoD IL-5, PCI DSS, SOC 2, CRA, Important Eight or HIPAA, groups want hardened, trusted open supply software program that mirrors their industrial workloads. Probably the most used FIPS photographs align with the broader portfolio, merely with cryptographic modules strengthened for audit and verification.
High FIPS picture initiatives embrace Python-fips (62% of consumers with not less than one FIPS picture in manufacturing), Node-fips (50%), nginx-fips (47.2%), go-fips (33.8%), redis-fips (33.1%), plus platform elements like istio-pilot-fips, istio-proxy-fips, and cert-manager variants. Even supporting libraries and crypto foundations present up, equivalent to glibc-openssl-fips.
FIPS shouldn’t be the entire story, but it surely illustrates a broader reality: compliance is a common driver, emphasizing the necessity for trusted open supply throughout the complete software program stack.
CVEs: Recognition does not map to danger
When wanting throughout Chainguard’s catalog of photographs, danger is overwhelmingly concentrated outdoors of the most well-liked photographs. Of the CVEs Chainguard remediated up to now three months, 214 occurred within the high 20 photographs, accounting for under 2% of the full CVEs. Transcend these high photographs, and you will find the opposite 98% of CVEs Chainguard remediated (10,785 CVE cases). That is 50 occasions the variety of CVEs within the high 20 photographs!
The most important quantity of CVEs are categorized as Medium, however operational urgency usually stems from how shortly Important and Excessive CVEs are addressed, and whether or not prospects can depend on that pace throughout their whole portfolio, not simply the commonest photographs.
Belief is constructed on remediation pace
For us, belief is measured in time-to-fix, and Chainguard is aware of that is most essential in relation to Important CVEs. In the course of the three-month interval analyzed, Chainguard’s group achieved a lower than 20-hour common remediation time for Important CVEs, with 63.5% of Important CVEs being resolved inside 24 hours, 97.6% inside two days, and 100% inside three days.
Along with Important CVE remediation, the group addressed Excessive CVEs in 2.05 days, Medium CVEs in 2.5 days, and Low CVEs in 3.05 days, notably sooner than Chainguard’s SLAs (seven days for Important CVEs and 14 days for top, medium, and low CVEs).
And this pace is not confined to the most well-liked packages. For each single CVE remediated in a high 20 picture undertaking, they resolved 50 CVEs in less-popular photographs.
That longtail is the place most of your actual publicity hides and it may well really feel hopeless making an attempt to maintain up. Most engineering organizations merely cannot allocate sources to patch vulnerabilities in packages that fall outdoors their core stack, however the information makes it clear that you must safe the “quiet majority” of your software program provide chain with the identical rigor as your most crucial workloads.
A brand new baseline for trusted open supply
Throughout the info, one takeaway stands out: fashionable software program is powered by a large, shifting portfolio of open supply elements, most of which reside outdoors the highest 20 hottest photographs. That is not the place builders spend their time, but it surely’s the place the majority of security and compliance danger accumulates.
This creates a regarding disconnect: it is rational for engineering groups to concentrate on the small set of initiatives that matter most to their stack, however the majority of publicity sits within the huge set of dependencies they do not have the time to handle.
That is why breadth issues. Chainguard is constructed to soak up the operational burden of the longtail, offering protection and remediation at a scale that particular person groups cannot justify on their very own. As open supply provide chains develop extra complicated, Chainguard will proceed to trace utilization patterns and shine a lightweight on the place danger actually resides, so you do not have to struggle the battle towards the longtail alone.
Able to get began with the trusted supply for open supply? Contact Chainguard to be taught extra.
Be aware: This text was expertly written and contributed by Ed Sawma, VP Product Advertising, Sasha Itkis, Product Analyst.
