What is melange? Overview and FAQ

No. Chainguard built melange as part of its open source tooling used for the Wolfi operating system. While you can check out the project on GitHub and learn more, it’s not a prerequisite for using or working with Chainguard Containers.

melange apks are defined declaratively using a YAML file.

Yes, melange is built to be compatible with apk-based systems including Alpine.

No, it’s not possible to mix Alpine apks with Wolfi apks.

Signing packages is not mandatory, but it is a recommended practice, because it allows users and automated systems to verify that the package they downloaded was built by the same person who signed it, and that it hasn’t been tampered with.

Some systems may prevent installation of your apk if they can’t attest the package provenance. This is the case with apko, which by default will fail any builds that reference unsigned packages.

Although melange supports inclusion of sub-pipelines, this feature currently only supports the built-in pipelines (such as make, split and others) that can be found at the pkg/build/pipelines directory on the main project repository.