About this role.
Canonical is seeking an EMEA-based software engineer to build and maintain hardened Ubuntu-based container images, known as rocks, for broad developer use. The role owns the lifecycle from upstream source through automated building, testing, vulnerability scanning, signing, publication, promotion, and retirement. Candidates need practical Bash, Python, Linux, container, and CI/CD experience, plus strong end-to-end ownership and written communication in a distributed environment. The position also involves security and supply-chain practices, collaboration with product and platform teams, mentoring, documentation, and up to 15% international travel. It is suitable for engineers with roughly 0-7 years of relevant experience who want to deepen expertise in cloud-native security, release engineering, and open source.
Role DNA
A quick view of the complexity, pace, ownership and collaboration implied by the job description.
Job Complexity
4/5Pace & Pressure
4/5Autonomy Level
4/5Communication Load
4/5Salary analysis
Estimated compensation compared with the broader US market for similar roles.
Core skills
Skills and capabilities most closely associated with this opportunity.
Cover letter sample
Dear Hiring Team,
I am excited to apply for the Software Engineer - Secure Container Images role at Canonical. My experience with Linux, Python, Bash, container image construction, and CI/CD automation aligns well with building secure, maintainable Ubuntu-based artifacts at scale.
I bring an ownership mindset across design, testing, documentation, release operations, and cross-functional collaboration, with a strong interest in software supply-chain security and DevSecOps practices.
I would welcome the opportunity to help improve hardened container images, mentor teammates, and contribute to Canonical's open-source mission in a distributed engineering environment.
Sample interview questions
I would use a minimal trusted base, pin and verify upstream dependencies, build reproducibly where possible, run functional and vulnerability tests, generate an SBOM, sign the image and attestations, and publish only after policy checks pass. I would also define a patching and retirement process so the image remains secure throughout its lifecycle.
I would first validate the finding, identify the affected package and reachable code path, review available fixes and upstream guidance, and assess exploitability in the image's intended use. I would then update or mitigate the dependency, rebuild and test the image, document the decision, and publish a signed remediation with an updated SBOM where appropriate.
I would structure the pipeline as reusable, version-controlled stages for building, testing, scanning, signing, promotion, and rollback. I would use immutable artifacts, provenance records, policy gates, isolated credentials, caching, parallel execution, and clear observability so failures are diagnosable and releases are repeatable across architectures.
I would begin with the smallest practical runtime base, use multi-stage builds, remove package-manager caches and build tools, run as a non-root user when feasible, and include only required runtime libraries. I would verify that size reductions do not break compatibility, patchability, debugging needs, or security controls.
I would communicate the context, impact, options, recommendation, and owner in a concise written proposal, supported by reproducible evidence such as build logs, test results, and vulnerability data. I would invite review early, record the decision, and follow up with clear documentation so distributed teammates can operate and maintain the result.
With more than 10 billion pulls, Canonical’s container images are trusted by developers worldwide to build and run software securely and at scale. That trust rests on our commitment to hardened, production-ready images.
We are advancing the state of the art with a new generation of Ubuntu-based container images we call “rocks”: minimal images engineered for performance and usability and backed by long-term security commitments. As a member of the team, you will own the path from upstream source to published image, turning open source software into tested, signed, and continuously maintained artifacts that developers can deploy with confidence.
This is fast-paced, multi-disciplinary software engineering. Because most of the software we package originates from third-party upstreams, you will work across a broad range of container technologies and hundreds of open source projects, often in several programming languages, integrating and maintaining them so they are easy to consume on Ubuntu. Automation is central to the role: you will build the pipelines that package, build, test, and publish images at scale.
Your seniority in this role will reflect your software engineering experience and your ability to mentor and guide more junior colleagues.
Location: This role is based in the EMEA region
This role entails
- Build and maintain a growing portfolio of high-quality, hardened container images
- Design and operate automated CI/CD pipelines that build, test, scan, sign, publish, promote, and retire images across environments and architectures
- Write tooling and tests to assess security compliance and cloud-native compatibility
- Work closely with the community and partners to share container expertise and keep our portfolio current with new features, patches, and applications
- Collaborate with our product security, platform, infrastructure, and customer-facing teams
- Contribute technical input to the team’s decision-making
- Set the standard for quality, defining image standards that span security, compatibility, performance, size, and developer experience
- Grow our knowledge base and write about the work we do
- Work in a collaborative, agile, and globally distributed environment
- Mentor colleagues and contribute to hiring
- Work from home with global travel of up to 15% for internal and external events
What we are looking for in you
- Proficiency in Bash and Python
- Experience working with CI/CD systems (e.g. GitHub Actions, Jenkins)
- Experience building container images
- Command of at least one container management or orchestration tool (e.g. Docker, Podman, or Kubernetes)
- Hands-on experience with Linux systems, package management, build systems, release engineering, or artifact pipelines
- Clear communication and end-to-end ownership, spanning design, review, documentation, operation, and cross-team collaboration
- A commitment to sharing knowledge and helping those around you grow
- A genuine appetite for learning and for working outside your comfort zone
- A Bachelor’s degree or equivalent in Computer Science, a STEM field, or a similar discipline
- An exceptional academic track record from both high school and university
- Business level written and spoken English.
- Sincere personal motivation aligned with our mission.
- International travel 2-4 times a year for company events up to two weeks long.
- 0-7 years relevant experience.
In addition we expect that you will match our values, by being:
- Precise, taking care to deliver correctness and clarity.
- Reliable, delivering high quality work that builds trust and confidence.
- Accessible, collaborating to build products and systems that are usable.
- Adroit, blending enthusiasm, knowledge, adaptability, style and character.
Nice-to-have skills
- A security-oriented maintenance mindset: you can investigate dependency and vulnerability findings, assess their impact, and deliver a safe fix
- An understanding of software supply chain security, with some experience generating and consuming artifacts such as SBOMs, signatures, provenance, or CVE reports
- Familiarity with GitOps principles and workflows
- Familiarity with additional languages such as Go or Rust
- Hands-on experience building minimal and distroless container images
- Knowledge of the OCI specifications
- Familiarity with security or compliance frameworks such as CIS, NIST, FedRAMP, or DISA STIG
- Evidence of contributions to open source projects
- A passion for embedding security across all stages of the engineering lifecycle (DevSecOps), and an interest in using AI or agentic development responsibly and safely
- Relevant Linux, container, or cloud-native certifications (such as CKS or DCA) are welcome
If your experience is close but does not match every requirement, we encourage you to apply. We value transferable experience from Linux packaging, release engineering, build systems, platform engineering, and open-source maintenance.
What we offer colleagues
We consider geographical location, experience, and performance in shaping compensation worldwide. We revisit compensation annually (and more often for graduates and associates) to ensure we recognize outstanding performance. In addition to base pay, we offer a performance-driven annual bonus. We provide all team members with additional benefits, which reflect our values and ideals. We balance our programs to meet local needs and ensure fairness globally.
- Distributed work environment with twice-yearly team sprints in person
- Personal learning and development budget of USD 2,000 per year
- Bi-annual compensation review
- Company recognition rewards
- 40 days annual leave per annum, including public holidays and our All Company holiday periods
- Maternity and paternity leave
- Team Member Assistance Program & Wellness Platform
- Opportunity to travel to new locations to meet colleagues, with Priority Pass for lounge access
About Canonical
Canonical is a pioneering tech firm at the forefront of the global move to open source. Our platform, Ubuntu, is very widely used in breakthrough enterprise initiatives such as public cloud, data science, AI, engineering innovation, and IoT. Our customers include the world’s leading public cloud and silicon providers, and industry leaders in many sectors. We are founder-led, profitable, and growing.
Powered by worldwide distributed collaboration since our inception in 2004, we believe tech and business leadership can emerge anywhere. We have no central headquarters. Most of us work from home, but we are exceptionally disciplined about this. We have very high expectations of all colleagues, and are champions of excellence. Working here is a step into the future and will challenge you to think differently, work smarter, learn new skills, and raise your game.
Canonical is an equal opportunity employer
We are proud to foster a workplace free from discrimination. Diversity of experience, perspectives, and background create a better work environment and better products. Whatever your identity, we will give your application fair consideration.
Annual salary information is not provided for this position. Explore salary ranges for similar roles in our Salary Directory ›
Upload your resume now
- To unlock remote work opportunities and be discovered by global employers.
This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content.
