The Complete Production SOP: How to Deploy and Run Chainguard Wolfi Zero-CVE Secure Container Images in Autonomous AI Agents

---
name: "chainguard-wolfi-zero-cve-images"
description: "Build lightweight, glibc-compatible Linux containers designed for zero known vulnerabilities."
metadata:
  author: "Chainguard"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "use wolfi base image"
  - "build zero cve container"
  - "chainguard image migration"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Chainguard Wolfi Zero-CVE Secure Container Images
Develops container images using Wolfi OS and Chainguard Images: leveraging modern apk packages with glibc support, automated daily CVE remediation patches, minimal SBOM attestations, and non-root defaults.

# Build stage using Wolfi base with glibc and build dependencies
FROM cgr.dev/chainguard/wolfi-base:latest AS builder

RUN apk update && apk add --no-cache \
    build-base \
    python-3.12 \
    py3-pip

WORKDIR /app
COPY requirements.txt .
RUN python3 -m venv /app/venv && \
    /app/venv/bin/pip install --no-cache-dir -r requirements.txt

# Runtime stage using minimal Chainguard Python runner (nonroot user UID 65532)
FROM cgr.dev/chainguard/python:latest

WORKDIR /app
COPY --from=builder /app/venv /app/venv
COPY --chown=nonroot:nonroot . /app

ENV PATH="/app/venv/bin:$PATH"
USER nonroot
ENTRYPOINT ["python3", "main.py"]

#!/usr/bin/env bash
# Verify agent invoked the correct Chainguard base registry
grep -E '^FROM cgr.dev/chainguard/' Dockerfile || {
  echo "Validation Failed: Dockerfile does not use Chainguard or Wolfi base image."
  exit 1
}
echo "Base image validated successfully."

#!/usr/bin/env bash
set -euo pipefail

IMAGE_TAG="local/secured-service:latest"

echo "Building Wolfi container..."
docker build -t "$IMAGE_TAG" .

echo "Running Trivy security audit for High/Critical CVEs..."
trivy image --severity HIGH,CRITICAL --exit-code 1 "$IMAGE_TAG"

echo "Zero-CVE verification complete! Clean build verified."