Inspired with Alexa von Tobel
00:10:12 · Alexa von Tobel
[00:10:12] S1: Let's talk a little bit about Chainguard today. So you've been up and running for about five years. What you've accomplished in a short period of time is really remarkable, but your platform spans 2,000 open source projects. I'm sure that number's even out of date. 100,000 plus libraries and hundreds of thousands of container images, all continuously rebuilt and maintained. First of all, how'd you get that that big that quickly? Talk a little bit about literally the accumulation of code.
00:10:41 · Dan Lorenc
[00:10:41] S0: Yeah. It's one of these things where, you know, I I love the the sayings, the engineers' credo. We do these things not because they are easy, but because we thought they would be easy when we started. And, you know, we we didn't know how hard it was gonna be. We just started doing it. And, you know, the first 10 or 20 projects we did this for really kinda proved out the market demand. Everyone wanted these. They wanted more than we had, as fast as we could possibly add more, you know, software packages to this catalog that we sell. And, you know, we just sort of looked... Stepped back and looked at it. It's a lot of work to do this. It's a lot of work to maintain the software. But the business model itself is classic economies of scale. You know, everyone at the end of the day is using mostly the same open source. And the old way this worked was every company was doing this kind of same thing themselves for the portion of that open source that they needed. You know, in the beginning, our our gross margins were terrible. They were negative. We were losing money on every deal because we had to spend so much time to build and maintain all of this software. Yep. But it's just resale of that same software. And so you you kinda draw it out of, like, the more customers we get, the better our margins get. The cost doesn't go up as we add more and more customers to this. And we can afford to invest even more in automation. And so it sort of builds this flywheel where the business gets better the more we sell and the faster we sell, And then we can afford to invest even more to make the catalog grow faster and maintain it all for cheaper.
00:11:58 · Alexa von Tobel
[00:11:58] S1: We always say we like businesses that get bigger... That as they get bigger, they get better. Yes. Right. And this is a perfect example of one. Quickly, let's just, like, give a real life example of what a customer... Just, like, give us an example of a customer, what they come to Chainguard for, what they get, how you safe proof it, and just kind of walk us through a real life example.
00:12:19 · Dan Lorenc
[00:12:19] S0: Yep. Our customers, I think we have a little over 600 of them now, and they span from, you know, 10 person startups to, you know, Fortune five companies. We're running inside of defense systems in outer space, kind of in all of these embedded systems too in places I didn't even know open source was used that prevalently. Oh, it's kinda scary at the end of the day, many places the software is deployed. But, yeah, at the end of the day, people are used to downloading software from this fragmented collection of, ecosystems and hubs and websites that kind of aggregate and store open source. And so when a customer gets it from us, they just kind of do a one for one swap. They change the version they were getting, to the version they get from us. That could be a container image, a programming language library if you're, you know, writing Python or JavaScript or something like that, and swap it out. We go through that software, and we patch all of the vulnerabilities that get reported. We fix all of the CVEs that show up in security scanners, and then run that through our secure build system and hand that to our customers. So for the most part, it's just kinda changing out what you were getting with a better version of it.
00:13:23 · Alexa von Tobel
[00:13:23] S1: Okay, Dan. I'm gonna ask a really dumb question just because I want everybody out there to actually learn and understand how this works. How do you get it clean? How do you... And and to your point, you started this saying, literally, you have countries that we are at war with on purpose injecting problematic software into these places. And you just said some of the software is going into places like outer space, like places where we really don't want there to be a mistake. Yeah. So it's pretty critical that this software is safe and, you know, not laden with a bunch of problematic code. How do you how do you safeguard it?
00:14:02 · Dan Lorenc
[00:14:02] S0: Yeah. We have a lot of automation for this, and it's a business of edge cases. So there's no single answer. Right? But we have tons and tons of automation, and we keep building more and more automation to do this. And then we also have a team of people manually doing these checks and work and patching and builds, for the areas our automation can't handle. And we keep giving them more and more work to do as we keep growing and scaling all the software we have, and then we also keep giving them better and better tools to do that work in. You know? But it starts at the very beginning. It starts by, you know, getting the source code, the very rawest source code, and the source code for all of the dependencies of that kind of thing and checking it, running it through process, patching everything that we find in it after we scan it, getting that built, figuring out how to build it, and then reassembling everything back together again in the end and handing that to our customers. We call that part of it the software factory that we built, and it's a lot of work every time we have to hook that up to the automation and hook that up into our factory so the automation can take over. And then there's automation that finds places the automation can fix something and escalates that to the team, and the team, you know, manually does that work, but then figures out how the automation could handle that kind of thing in the future.