Chainguard
Hardened zero-CVE container images and trusted open-source artifacts.
About
Chainguard rebuilds popular open-source software into minimal, hardened container images that the company reports carry 97.6% fewer CVEs than public alternatives, stepping teams off the daily CVE-remediation treadmill. Its catalog spans 3,000+ container images rebuilt from source daily, alongside hardened language libraries for Python, Java, JavaScript, Go, and .NET, VM images, OS packages, secure CI/CD actions, and agent skills for AI-powered development workflows.
Every artifact ships with SLSA L3 provenance and SBOMs, with FIPS-validated variants for regulated environments and compliance support spanning FedRAMP, PCI DSS, SOC 2, and HIPAA (all provider-stated). Teams pull from the cgr.dev registry as drop-in replacements for upstream images, and the platform adds policy enforcement so only vetted artifacts enter the build. Chainguard is a commercial platform with a free starting tier; its founders include the creators of Sigstore.
What it can do
- 3,000+ minimal container images rebuilt daily from source
- Hardened language libraries for Python, Java, JS, Go, .NET
- SLSA L3 provenance and SBOMs on every artifact
- Policy enforcement for approved open-source consumption
- FIPS images and compliance-ready documentation
Setup
Create an account at chainguard.dev, authenticate with chainctl, and pull images from cgr.dev/chainguard.
Prerequisites
A Chainguard account; container runtime for pulling images.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via official site at https://www.chainguard.dev (3,000+ images, SLSA L3, SBOMs, FIPS, compliance list all from official FAQ/copy); Extensive reputable press coverage of the company; CVE-reduction percentages are provider-claimed; Founders include Sigstore creators (public record).
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.