Chainguard Apko Integration Guide

Integrate Chainguard apko with Vulnetix. Build minimal container images from APK packages and automatically generate SPDX SBOMs. Upload the SBOM to Vulnetix for supply chain tracking.

Install & scan

$ # Install via Go
go install chainguard.dev/apko@latest

# macOS via Homebrew
brew install apko
$ # Build a container image from apko.yaml
# SBOM is automatically generated as sbom-<arch>.spdx.json
apko build apko.yaml myapp:latest myapp.tar

# Load into Docker
docker load < myapp.tar

# Upload SBOM to Vulnetix
vulnetix upload --file sbom-amd64.spdx.json

Run Chainguard Apko in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install apko
  run: go install chainguard.dev/apko@latest

- name: Build image and generate SBOM
  run: apko build apko.yaml myapp:${{ github.sha }} myapp.tar

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: chainguard-apko
    path: sbom-amd64.spdx.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Chainguard Apko's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Chainguard Apko. Keep running it. Vulnetix sits on top of Chainguard Apko (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Chainguard Apko is strongest at its core category and also carries features in SBOM Generation, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Chainguard Apko does well

• Builds OCI images directly from APK packages via a declarative YAML manifest with no Dockerfile and no build environment, producing minimal/distroless images (often single-digit MB)
• Fully reproducible by default: identical inputs yield bitwise-identical images, with the creation timestamp pinned to epoch so layer digests are stable
• Emits a signed high-fidelity SPDX SBOM at build time from ground truth, rather than reconstructing one after the fact
• Pairs with melange and cosign for keyless OIDC signing, giving an end-to-end reproducible, attestable software factory

Where Vulnetix adds to it: apko is a build tool, not a scanner: it produces clean, minimal images plus an authoritative SPDX SBOM but runs no vulnerability, SCA, malware, secrets or IaC analysis. Vulnetix ingests the apko-produced SBOM and scans/prioritises it, adding cross-scanner dedup, exploit-intel (EPSS/KEV/ESS/LEV), reachability, versioned VEX, autofix, EOL and SSVC. The two are complementary: apko shrinks the attack surface at build time, Vulnetix governs and remediates what remains.

No migration, no rip-and-replace. Chainguard Apko keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Chainguard Apko results in Vulnetix

Upload Chainguard Apko SPDX, CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Chainguard Apko documentation ↗  ·  Source repository ↗

Wire Chainguard Apko into your CI/CD pipeline →