> ## Documentation Index
> Fetch the complete documentation index at: https://site.aspect.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Build Wolfi images with Bazel: Introducing rules_apko

> Learn about rules_apko, a Bazel plugin for building secure, minimal Wolfi-based container images with reproducible, air-gapped builds.

export const BlogPost = ({title, date, authors, tags, image, children}) => {
  const tagList = tags ? tags.split(", ").filter(Boolean) : [];
  const tagSlug = t => t.toLowerCase().replace(/&/g, "").replace(/\+/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
  const formattedDate = date ? new Date(date + "T00:00:00").toLocaleDateString("en-US", {
    year: "numeric",
    month: "long",
    day: "numeric"
  }) : "";
  return <section className="w-full flex justify-center px-4 py-12 md:py-16">
      <div style={{
    maxWidth: "800px",
    width: "100%"
  }}>
        {image && (typeof image === "string" ? <img noZoom src={image} alt={title} className="w-full rounded-xl mb-8" style={{
    maxHeight: "400px",
    objectFit: "cover"
  }} /> : <div className="blog-post-hero-image">{image}</div>)}
        <h1 className="text-3xl md:text-4xl font-bold text-zinc-900 dark:text-white">
          {title}
        </h1>
        <div className="flex flex-wrap items-center gap-3 mt-4 text-sm text-zinc-500 dark:text-zinc-400">
          {authors && <span>{authors}</span>}
          {authors && formattedDate && <span>·</span>}
          {formattedDate && <span>{formattedDate}</span>}
        </div>
        {tagList.length > 0 && <div className="flex flex-wrap gap-2 mt-3">
            {tagList.map(tag => <a key={tag} href={"/blog/tags/" + tagSlug(tag)} className="px-2 py-0.5 rounded-full text-xs bg-zinc-100 dark:bg-zinc-800 text-zinc-600 dark:text-zinc-400 hover:bg-blue-100 dark:hover:bg-blue-900/40 hover:text-blue-700 dark:hover:text-blue-300 transition">
                {tag}
              </a>)}
          </div>}
        <hr className="my-8 border-zinc-200 dark:border-zinc-700" />
        <div className="prose dark:prose-invert max-w-none">{children}</div>
      </div>
    </section>;
};

export const MarketingPage = () => <div className="marketing-page-marker" style={{
  display: "none"
}} />;

export const Section = ({children, className = "", gray = false, dark = false, id}) => <section id={id} className={`w-full flex justify-center px-4 py-16 md:py-24 ${gray ? "bg-gray-50 dark:bg-zinc-900" : dark ? "bg-zinc-900 dark:bg-zinc-950" : ""} ${className}`}>
    <div className="w-full" style={{
  maxWidth: "1140px"
}}>
      {children}
    </div>
  </section>;

<MarketingPage />

<BlogPost title="Build Wolfi images with Bazel: Introducing rules_apko" date="2023-10-26" authors="Alex Eagle" tags="Containers & OCI, Releases, Bazel">
  <img noZoom src="https://mintcdn.com/aspectbuild/x1L7Iep716jCyJVo/images/blog/hashnode/hn-49d35a17e8.jpeg?fit=max&auto=format&n=x1L7Iep716jCyJVo&q=85&s=5eb0a2730290b3f083fc3d70869d3c0f" alt="" className="blog-post-cover" width="1254" height="836" data-path="images/blog/hashnode/hn-49d35a17e8.jpeg" />

  > Co-author: **Adam Dawson, Principal Product Manager at Chainguard**\
  > Cross-posted with Chainguard: [https://www.chainguard.dev/unchained/announcing-bazel-rules-for-extending-chainguard-images](https://www.chainguard.dev/unchained/announcing-bazel-rules-for-extending-chainguard-images)

  Yesterday during [BazelCon 2023](https://conf.bazel.build/), in partnership with [Chainguard](https://www.chainguard.dev/), I announced the general availability of rules\_apko, an open source plugin for Bazel, which makes it possible to build secure, minimal [Wolfi-based](https://wolfi.dev/) container images using the popular Bazel build system. This plugin allows Bazel users to build OCI container images with the open source community un-distro, [Wolfi](https://www.chainguard.dev/unchained/small-cctopus-and-a-big-idea-the-story-of-how-a-one-year-old-linux-un-distro-is-improving-the-clouds-software-supply-chain), using their existing pipelines and workflows in Bazel.

  ### **Apko is for more secure, distroless container images based on the Wolfi un-distro**

  [Apko](https://edu.chainguard.dev/open-source/apko/getting-started-with-apko/?__hstc=1638499.71f16f5dd1368de0901e703ea3789e0a.1698301063806.1698301063806.1698301063806.1&__hssc=1638499.3.1698301063806&__hsfp=1457483275) is an open-source project developed by Chainguard for producing minimal, low-CVE, distroless container images using the Wolfi un-distro. Apko is used to assemble distroless base images and Wolfi's extensive library of APK packages (or packages you create) into an OCI-compliant container image that is fully reproducible and has a complete software bill of materials (SBOM).

  ### **Bazel is for fast, reproducible builds**

  [Bazel](https://bazel.build/) is the open-sourced version of Google’s internal build tool, commonly used in multi-language monorepos to get faster and more reproducible builds. Bazel relies on plugins, called “rulesets,” to understand how to build images. Since Bazel can understand most languages, it’s a single tool that can produce images containing any application code. It also provides hermeticity and determinism guarantees, allowing a secure software supply chain to propagate from the package manager all the way to your production images.

  ### **Introducing rules\_apko**

  rules\_apko is a new Bazel ruleset for building OCI images using Wolfi-base images and APKs within existing Bazel workflows. 

  Previously under Bazel, users had to build base images outside of Bazel and manually update them in the Bazel configuration, or use the non-performant and now deprecated `container_run_and_*` APIs in rules\_docker.

  rules\_apko generates a fully locked and verifiable description of all transitive dependencies. Bazel then downloads individual APK packages needed for the requested build targets, and creates an OCI-format base image containing the installed packages. This base image can then be further extended by rules\_oci to append artifacts built from sources in the repository.

  Benefits of using apko and Wolfi-base images with Bazel include:

  * Supply chain security assurances in Bazel that the APK packages fetched have the same integrity hashes as the lock file.

  * Bazel can build any application code in any language and add to the image.

  * Bazel coordinates test runners where container images are required as inputs.

  * Bazel can enable fully-offline (“air gapped”) builds with rules\_apko.

  * Assurances that the resulting image is fully reproducible and has a complete SBOM.

  ### **Getting Started with rules\_apko**

  rules\_apko is available today and it's easy to get started building secure, minimal container images in Bazel:

  * Run the `apko resolve` command to produce the `apko.resolved.json` file. Note: the resolve command is undocumented and is available in the [newest release](https://github.com/chainguard-dev/apko/releases/tag/v0.11.0) of apko.

  * Follow the [install instructions](https://github.com/chainguard-dev/rules_apko#installation) to add rules\_apko to your Bazel project.

  * Call the `translate_apko_lock` Bazel API to import the `apko.lock.json` file so that Bazel can download and verify the integrity of remote assets.

  * Add `apko_image` targets to your BUILD files to create base images.

  Take a look at the [https://github.com/chainguard-dev/rules\_apko/tree/main/examples](https://github.com/chainguard-dev/rules_apko/tree/main/examples) for more ideas of how to use rules\_apko to create secure, reproducible container images for your enterprise applications.

  ### **Resources**

  To learn more about using rules\_apko for distroless container images, check out the following additional resources:

  * rules\_apko project on [GitHub](https://github.com/chainguard-dev/rules_apko)

  * Bazel rules for apko [documentation](https://edu.chainguard.dev/open-source/apko/bazel-rules/?__hstc=1638499.71f16f5dd1368de0901e703ea3789e0a.1698301063806.1698301063806.1698301063806.1&__hssc=1638499.3.1698301063806&__hsfp=1457483275) on Chainguard Academy

  You can try [Chainguard Images](https://www.chainguard.dev/chainguard-images) for [free today](https://console.enforce.dev/auth/login) to see for yourself how we're working to improve the container image landscape with a secure-by-default design. Our free and public Images are available on the `:latest` and `:latest-dev` versions only. If you're interested in learning more or have additional questions regarding our Chainguard Images Enterprise features and capabilities, [please reach out](https://www.chainguard.dev/contact) to our team for more information.

  Aspect would like to extend our special thanks to the team at Chainguard for sponsoring the work of developing rules\_apko!
</BlogPost>