The State of Trusted Open Source Report

In December 2025, we shared the first-ever The State of Trusted Open Source report, featuring insights from our product data and customer base on open source consumption across our catalog of container image projects, versions, images, language libraries, and builds. These insights shed light on what teams pull, deploy, and maintain day to day, alongside the vulnerabilities and remediation realities these projects face.

Fast forward a few months, and software development is accelerating at a pace that most didn’t see coming. AI is increasingly embedded across the development lifecycle, from code generation to infrastructure automation, as models become more advanced and better at meeting the demands of modern work. This shift is expanding what teams can build and how quickly they can ship.

It is also reshaping the security landscape.

Before diving into the numbers, it’s important to explain how we perform this analysis. We examined over 2,200 unique container image projects, 33,931 total vulnerability instances, and 377 unique CVEs from December 1, 2026, through February 28, 2026. When we use terms like “top 20 projects” and “long tail projects” (as defined by images outside of the top 20), we’re referring to real usage patterns observed across our customer portfolio and in production pulls.

In this report, we noticed a few new themes that point to this shift. These themes built on the trends from our last report, ultimately showcasing the impact of increased AI-driven development both in the types of container images being used and in the number of CVEs being discovered and remediated:

Python and PostgreSQL growth reflects AI-driven development: Python remains the most popular image (72.1% of all customers use it), and PostgreSQL saw a 73% increase in usage quarter-over-quarter, underscoring the growing adoption of a modern AI stack across various use cases.

The modern platform stack is becoming increasingly standardized: Across Chainguard customers, language ecosystem images account for more than half of the top 25 images used in production.

Chainguard Base is becoming a foundation for developer tooling: The chainguard-base image, a minimal distroless base image without any toolchain or apps, was the 5th most-used Chainguard image, as customers use it as a sort of “utility belt” for their specific use cases (over 75% of Chainguard customers customize at least one image).

AI is accelerating software development and vulnerability discovery: We applied over 300% more fixes in Chainguard Containers and saw a 145% increase in vulnerabilities from last quarter, signaling the use of AI to push more code and discover more CVEs.

The long tail continues to define real-world risk: 96% of the vulnerabilities found and remediated in Chainguard Containers occurred outside of the top 20 most popular projects—this is consistent with the findings from December.

Compliance continues to drive adoption of trusted open source: We saw the same themes from December present here, underscored by a FIPS-compliant variant of a Chainguard container image entering the top 10 images by customer count for the first time.