What's what with Wolfi, the Linux "undistribution," and ARM
There are many ways to get serious about securing Linux on a container. Heck, Microsoft has one, Common Base Linux (CBL)-Mariner. Others include Alpine Linux, Flatcar Container Linux, Red Hat Enterprise Linux CoreOS (RHCOS), and RancherOS. The name of this game is to shrink down Linux to the smallest possible size so that its attack surface is tiny. Then, there's Chainguard's Wolfi. Here, there's no Linux kernel at all.
How do they manage that? Simple. Wolfi relies on a kernel being provided by an underlying container runtime. Secure that, and you're safe from most kernel-based attacks.
Chainguard CEO and founder Dan Lorenc told me at Open Source Summit Europe in Dublin, A Linux container is "a distro that boots up on hardware and gets you to a container runtime. Alpine is probably the most heavily used such distro. Wolfi is the opposite of this. It's distroless. It's minimal to the point of not even having a package manager." It has just enough to run your containerized application, and that's it.