Azul & Chainguard partner on zero-CVE Java containers
The collaboration will see Chainguard create Java container images built from source, incorporating Azul's commercially supported build of OpenJDK from the Azul Platform Core. This approach is designed to allow enterprises to deliver production workloads more efficiently while addressing the complexities of securing the full software stack for Java applications.
Complexity in Java security
Java remains integral to a wide range of enterprise applications, with growing challenges around ensuring timely access to secure builds. Securing Java workloads requires reliable updates and consistent patching, traditionally necessitating expertise and timely intervention by vendors. Azul aims to fulfil this role by delivering fully supported OpenJDK builds intended as a direct replacement for Oracle Java, enabling organisations to maintain compliance and security while reducing expenditure and freeing development teams from remediation tasks.
Chainguard Containers supports customers by securing operating systems and application runtime environments. The combination targets gaps in current protection practices that too often see engineering and security teams handle numerous vulnerability disclosures, deal with inconsistent patching, and attempt to harden containers without slowing developer productivity. For Java workloads, which require both rapid security response and commercial support, these difficulties are particularly pressing.
Recent research from NetRise indicates that the average container carries 604 known vulnerabilities in underlying software components. Notably, over 45% of these CVEs are two to ten years old. This accumulation of unaddressed vulnerabilities increases risks for organisations that depend on containerised apps.
Findings from Azul's 2025 State of Java Survey & Report further highlight the impact of security issues. According to the report, 33% of respondents stated their DevOps teams spend more than half their time addressing false positives from Java-related vulnerabilities. Additionally, 49% of surveyed companies reported they are still encountering vulnerabilities from Log4j in production environments, nearly three years after the initial disclosure. The need to secure all layers, from operating systems to toolchains, forms a critical part of the software development lifecycle.
Hardened, zero-CVE Java containers
The partnership between Azul and Chainguard is positioned as a direct response to challenges identified by industry research. The joint offering will deliver zero-CVE containers for Java versions 21 and above, built from Azul's source code and supported commercially through Azul's Java expertise. Customers are expected to benefit from a streamlined way to secure Java application foundations, reducing overall risk exposure and enabling more consistent, reliable deployments.
The new container images will be constructed entirely from source and tested in accordance with the Java Compatibility Kit, providing assurance of compatibility and feature parity. Azul's approach to stabilised, security-only Critical Patch Updates gives engineering teams the opportunity to deploy updated Java images more efficiently, minimising manual patching and testing efforts. This is intended to help organisations redirect development resources away from platform maintenance and towards application delivery. "Our customers need solutions that reduce risk and build trust at every layer of their modern software deployment stack," said Dan Lorenc, co-founder and CEO at Chainguard. "Today, we're bringing Chainguard's expertise in building minimal, zero-CVE images and Azul's expertise in Java together to create the most secure, commercial-grade containers for cloud-native workloads."
Scott Sellers, co-founder and CEO at Azul, added: "Choosing a hardened container shouldn't mean sacrificing timely security-only updates and commercial support services for your Java runtimes. Today, we're excited to offer enterprises best-in-breed hardened Java containers from Chainguard while leveraging world-class commercial support from Azul."
Customers adopting Azul Java container images through Chainguard Containers will have access to commercial Java support within the Azul Platform Core portfolio. This ensures ongoing access to patches and direct assistance for Java runtime issues in critical enterprise environments.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
3 days ago
- Techday NZ
Chainguard launches partner programme after $356 million raise
Chainguard has announced the launch of its Global Partner Program aimed at helping channel partners deliver trusted open source software to customers. The new initiative intends to bridge the gap between traditional channel models and increasingly complex cloud ecosystems. Chainguard will be working alongside several major cloud service providers, including AWS, Google Cloud Platform, and Microsoft Azure, to offer more cohesive and scalable security solutions through its channel partners. Key programme features The Chainguard Partner Program introduces a two-tier structure with increasing benefits based on partner engagement and impact. Among the main features are incentives via sourced deals, co-sell influence, and customer referrals. Technical enablement is a significant component, with partner-exclusive training, onboarding, deal registration, lead creation tools, and access to both Partner and Technical Advisory Councils. The programme also offers joint go-to-market support, including account mapping, sales enablement, marketing support, and co-branded initiatives. Early adopters are given a first-mover advantage in delivering a new solution category before competitors can enter the space. The launch and expansion of this programme are being supported by Chainguard's recent Series D funding round, which saw the company raise $356 million at a valuation of $3.5 billion, intended to drive the company's next stage of growth. The need for secure OSS Open source software now accounts for more than 90% of the code in modern applications, significantly increasing the importance of robust software supply chain security. Recent high-profile incidents such as attacks targeting SolarWinds, Log4Shell, and xz-utils have elevated concerns among organisations, which now face stricter regulatory requirements and compliance mandates from frameworks such as FedRAMP, PCI, NIST SSDF, DORA, CRA, and HIPAA. The proliferation of sovereign cloud initiatives has added further complexity to compliance and risk management. "We're at a tipping point in software security. The growing reliance on open source, coupled with the rise in sophisticated supply chain attacks, has made it clear that reactive security models are no longer enough," said Ryan Carlson, President, Chainguard. "Organisations need to build fast, but they also need to do so securely – and that starts with trusted open source. With partners across the channel ecosystem, we're making it easier for the world's most innovative companies to build, deploy, and innovate on a foundation that's secure from the start." Chainguard's approach is to provide trusted open source software that is rebuilt from source in hardened environments, thereby supporting engineering teams in securely developing and deploying new code without additional burdens. Early engagement with channel partners The first members of the Global Partner Program include Bytes, Defy, DevOps1, and EVOTEK. These partners will use Chainguard to speed up developer productivity, facilitate compliance processes, and raise security standards for their clients. "At Bytes, we actively seek out vendors who disrupt conventional thinking and bring innovative perspectives to the cyber security landscape," said Luke Kiernan, Head of Cyber Security, Bytes. "From our first interaction with Chainguard, it was evident they embodied this mindset, delivering a forward-thinking, developer-first approach to securing the software supply chain. We look forward to developing our partnership and driving greater value for our customers through modern, resilient, and secure software practices." "Chainguard is solving one of the most urgent problems in enterprise technology today – securing the software supply chain without slowing down development," said Rich Douros, Chief Revenue Officer, Defy. "Their secure-by-default approach is exactly what our customers need to build with confidence and speed." "At DevOps1, our mission is to help our customers build secure, scalable systems that empower our clients to move fast without compromising security," said Alex Rea, CEO, DevOps1. "Partnering with Chainguard, the market-leading solution for software supply chain security, enables us to embed robust, verifiable security ensuring a 'Start Left' posture in the development lifecycle. This collaboration reinforces our commitment to delivering modern DevSecOps practices with confidence, integrity, and speed." "All organizations want to accelerate their software development, but they can't do that without having a way to secure the applications they're building," said Jason Myers, Chief Revenue Officer, EVOTEK. "Chainguard's approach to delivering continuously verified open source software aligns perfectly with our mission to help enterprises build secure, scalable infrastructure." Enhancing OSS integrity Chainguard's offerings centre around delivering open source components that are rebuilt from source within secure infrastructure and with verified end-to-end integrity. This is exemplified by Chainguard Containers, a catalogue featuring over 1,500 zero-CVE (common vulnerabilities and exposures) container images. The containers offer customisation, a reduced attack surface, and continuous daily updates, thereby ensuring supply chain integrity for containerised applications. Powered by Chainguard OS, the service includes transparent provenance, enforcement of FIPS cryptography, signed software bill of materials and attestations, and secure system hardening. For partners in the programme, this portfolio is designed to accelerate client compliance efforts, strengthen security postures, and enable engineering teams to focus on secure product development.
RNZ News
4 days ago
- RNZ News
More people making losses when selling their homes
The number of people losing money on home sales is at the level since 2014. Photo: RNZ / REECE BAKER The number of people making losses when they sell their homes is at the highest level since 2014, property data firm Cotality says, and Auckland sellers are being hit particularly hard. In three months, there was $128,362,612 lost by sellers. Cotality has released its latest Pain and Gain report, which shows the proportion of sellers making a loss or a gain on sales across the country. In the second quarter of this year, 89.4 percent of sellers made a gross profit - 10.6 percent made a loss. This does not include the cost of the sale, such as real estate commission. But in Auckland, the number losing money increased to 15.9 percent. In Tauranga, it was 13.2 percent and Wellington 11.9 percent. Christchurch had the smallest proportion of loss-making sales, at 4.9 percent. Cotality chief property economist Kelvin Davidson said it reflected how much prices had fallen in Auckland, and the higher number of apartments, which were more likely to lose money. The median profit among those who sold for a gain was $279,000. That is well down on the $440,000 median gain recorded during the 2021 peak, but higher than anything recorded before the end of 2020. The median loss was $52,500. Combined, the total gain made by sellers in the quarter was $4.9 billion. Cotality chief property economist Kelvin Davidson. Photo: SUPPLIED Davidson said the length of time that someone had owned a property played a big part in whether they made a gain or a loss. "Almost 50 percent of the loss-making resales in the three months to June had been held for less than three-and-a-half years." Those who made a gain had held their properties for 9.4 years. Davidson said that was the longest hold period for a gain since the mid-1990s. He said the weakness in property values could be encouraging some owners to hold for longer to allow gains to accumulate. "In other cases it may just reflect the fact that in a quiet market a lot of sellers simply have to wait longer for a deal to be achieved. "Indeed, some property owners may also just be choosing to hold for a bit longer if they're uncertain about their job prospects or don't want to pay transactions costs such as an estate agent's commission or conveyancing fees as regularly. In addition, lending restraints such as the loan to value ratio rules may have kept more people where they are for longer." He said investors could sometimes choose when to make a move but owner-occupiers were often driven by life events. It was not always a bad thing to move in a soft market, he said. "You might get less than what you might like for your own house but you may well get a bargain on the next one. "You might come out better off." He said there were hints that some sellers were choosing to take their properties off the market rather than accept a disappointing price. Wellington real estate salesperson Mike Robbers said he was seeing that. He said separating couples would sometimes put a house on the market, and then when offers came in lower than they wanted, one person would buy the other out instead . Standalone houses were less likely to sell for a loss. Almost 34 percent of apartments sold for less than they were bought for. Investors' experience was very similar to that of owner-occupiers, at 10.7 percent of sales making a loss compared to 10.1 percent for owner-occupiers. Investors had slightly larger gains when they made a profit and slightly bigger losses. In Auckland, 17 percent of investors were making a loss. Gareth Kiernan, chief forecaster at Infometrics, said the current downturn was so far shorter than one recorded from 1998 to 2001 and from 2008 to 2012. But he said there were signs that people who bought in the peak might have to hold on longer than in previous downturns to get back to neutral. "It's worth noting that house prices are currently still sitting about 13 percent below their 2021 peak. At the same stage of the cycle, 13 quarters after the December 1997 and December 2007 peaks, house prices were only 2.0 percent and 5.5 percent below those respective peaks. In other words, although the 1998-2001 and 2008-2012 loss-making periods were getting close to ending by this stage of the cycle, this time around we're still a long time away from everyone not facing a loss when selling property. Our current house price forecasts could see people in 2030 who bought at the peak of the market in 2021 still be making a loss if trying to sell. In the context of the NZ housing market experience of the last 75 years, that would be an incredibly long time to still be making a loss." Davidson agreed the downturn was "fairly prolonged". "The current cycle is deeper - in the GFC prices only fell about 10 percent peak to trough. This time they were down closer to 17 or 18 percent, we're three-and-a-half years into the cycle and nowhere near the peak. This has been a deeper and more drawn out episode. In some ways we're only halfway through or even less. "It's taking longer to accumulate gains and I guess it's also taking longer to avoid losses." Sign up for Ngā Pitopito Kōrero , a daily newsletter curated by our editors and delivered straight to your inbox every weekday.
Techday NZ
07-08-2025
- Techday NZ
AppSignal expands OpenTelemetry support for Go, Java & PHP
AppSignal has introduced expanded native support for OpenTelemetry, now allowing small and midsize businesses to monitor Go, Java, and PHP applications in addition to Ruby, Elixir, and With this update, AppSignal's application performance monitoring (APM) suite now provides automatic instrumentation, error tracking, and performance monitoring across six widely-used languages. The solution aims to offer engineering and development teams the flexibility to use the OpenTelemetry (OTel) standard, enabling complete monitoring and observability without the need for custom integration work or concern over vendor lock-in. Expanded language support AppSignal's new features include native support for the OpenTelemetry protocol (OTLP) covering traces, metrics, and logs. Customers can now benefit from automatic instrumentation and instant support for the Go (Gin, Echo), Java (Spring Boot), and PHP (Laravel, Symfony) frameworks. This is in addition to the existing support for Ruby, Elixir, and applications. Key aspects of the expansion include zero-configuration OTel collector integration, unified monitoring for all six languages, dashboards optimised to display runtime-specific metrics, and migration paths from proprietary AppSignal agents to OpenTelemetry instrumentation. Data portability and integration OpenTelemetry as an industry standard ensures that telemetry data collected through AppSignal can be used with any compatible platform. The smart sampling features now capture 100 percent of errors, trigger anomaly detection, and manage data volume to balance comprehensiveness and efficiency. The company's platform also transforms OTel data into actionable insights and provides pre-built visualisation dashboards and intelligent alerts. Wes Oudshoorn, Chief Product Officer at AppSignal commented, "Current OpenTelemetry tools typically overwhelm developers by dumping raw metrics, logs, and traces with little context. We took a different approach by adopting OTel rather than building proprietary language integrations. AppSignal translates OTel data into clear insights, showing developers exactly what is broken or slow without requiring them to piece it together themselves." "Now offering first-class support for PHP, Java, and Go through our OTel implementation, AppSignal also accepts any OTel data, enabling full-stack observability for virtually any setup. To simplify onboarding, we provide a hosted collector, so developers do not need to run their own. We are excited to welcome new programming communities to AppSignal and deliver the experience they expect from a modern observability platform." Simplicity and accessibility for SMBs AppSignal's updated APM suite is designed with pricing and onboarding simplicity in mind, targeting the requirements of SMB engineering teams. The implementation of a hosted OpenTelemetry collector means developers are not required to maintain their own, further reducing overhead and simplifying adoption. With native OTel integration, AppSignal customers can access full-stack observability for diverse software environments without needing to commit exclusively to one solution provider. This approach has been designed to support developers across a range of environments, languages, and frameworks. The company supports development teams in over 2,000 organisations across more than 60 countries. Its monitoring and logging solutions enable teams to automate monitoring workflows, address performance issues proactively, and improve the experience for end users.
