commercial-avocado

packaged by Chainguard

Chainguard Container for commercial-avocado

Avocado Systems ASP Plugin (avcd) delivers runtime application self-protection for containerized workloads.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/commercial-avocado:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

The commercial-avocado image packages the Avocado Systems ASP plugin (avcd), a proprietary runtime application self-protection agent supplied by Avocado Systems under a partnership with Chainguard. There is no public upstream image to compare against; Chainguard rebuilds the vendor-provided agent payload on Chainguard OS to give it daily rebuilds, a minimal footprint, and build-time SBOMs.

This image ships only x86_64 (amd64) binaries, because Avocado distributes the agent for that architecture alone. The agent is delivered as a bundled application under /opt/avcd, and its binaries link vendored libraries in /opt/avcd/lib64, which is not on the default loader path. Set LD_LIBRARY_PATH=/opt/avcd/lib64 whenever you invoke them directly.

The image runs as root, which the agent requires to enable protection through setuid, process forking, and the setuid appmanager. Like other production Chainguard Containers it contains no package manager. It is meant to be layered into or run alongside the application you want to protect rather than started as a standalone service.

Prerequisites

• An x86_64/amd64 host, since the agent is not built for other architectures.
• A valid Avocado Systems ASP license and access to an Avocado App Manager (APPM) endpoint. The agent enforces protection by registering with APPM, so the credential files under /opt/avcd/config must be provisioned from your Avocado subscription before the agent is functional.

Getting Started

The image is available on cgr.dev for organizations with access. Pull it with the following command:

docker pull cgr.dev/ORGANIZATION/commercial-avocado:latest

The image sets /usr/bin/avocado as its entrypoint, preconfigures LD_LIBRARY_PATH, and runs as root, because the agent manages protection at the VM or container level and requires root privileges. The agent control CLI (enable, disable, status, and the container-* variants) therefore runs directly. Run it with no argument to see its version and usage banner:

docker run --rm cgr.dev/ORGANIZATION/commercial-avocado:latest

Pass a subcommand to drive the agent, for example to report its status:

docker run --rm cgr.dev/ORGANIZATION/commercial-avocado:latest status

The typical deployment model is to layer the agent into the image of the application you want to protect using a multi-stage build. The LD_LIBRARY_PATH set on this image does not carry across a COPY --from, so set it again on the target image:

cat > Dockerfile <<EOF
FROM cgr.dev/ORGANIZATION/commercial-avocado:latest AS avocado

FROM cgr.dev/ORGANIZATION/your-app:latest
COPY --from=avocado /opt/avcd /opt/avcd
ENV LD_LIBRARY_PATH=/opt/avcd/lib64
EOF

The agent still needs a valid Avocado ASP license and a reachable APPM endpoint to enforce protection at runtime. Layering the payload in only makes the binaries and libraries available.

Configuration

The agent reads its configuration from /opt/avcd. Two settings control where it lives and how it loads:

• ADPL_DIR — the agent install root, defaulting to /opt/avcd. Override it only if you relocate the payload.
• LD_LIBRARY_PATH — preset to /opt/avcd/lib64 so the loader can resolve the vendored libraries. Keep this entry if you extend the variable.

Runtime credentials live under /opt/avcd/config (for example appm_cred.json and avocadoCA.cer). Provision these from your Avocado ASP subscription so the agent can authenticate to your APPM endpoint, and use the bundled configure-avocado helper to complete enrollment as described in the documentation shipped with your license.

Documentation and Resources

• Refer to Chainguard Academy for general guidance on working with Chainguard Containers.
• Contact your Avocado Systems representative for the ASP agent documentation, licensing, and APPM setup instructions that accompany your subscription.

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.