Link

Comprehensive CVE elimination from the start keeps builders shipping product, not patches.

Silence scanners with 97.6% fewer CVEs than OSS equivalents

Built from source to eliminate entire categories of OS-level risk that downstream approaches can't touch.

Chainguard Catalog Starter

Explore container images for over 2,000 projects, and hundreds of Helm charts, continuously rebuilt by AI reconciler agents in a SLSA Level 3 environment. No drift. No CVEs. No waiting on upstream vendors.

Deploy the Guardener to analyze and rebuild Dockerfiles layer by layer, map packages, and test incrementally to seamlessly use production-ready, Chainguard images.

Custom Assembly configures Chainguard Factory to build images to your specifications, powered by 30,000+ secure packages, customizable with your own certs and environment variables, and backed by our CVE remediation SLA.

Simplify compliance across frameworks like FedRAMP, PCI DSS, SOC 2, CMMC, and CRA with zero-CVE images, signed SBOMs, and full provenance built into every artifact. Over 700 FIPS-validated container variants and OS-level STIG hardening are available for regulated environments.

Extend Chainguard's secure-by-default standard to commercial ISV software.

Quickly and easily add packages to Chainguard Containers without spawning additional infrastructure and maintenance sprawl for your engineering team.

Direct access to the APKs underpinning your entitled Chainguard Containers so developers have a trusted source for secure packages.

Get updated EOL images with low-to-zero CVEs for up to 6 months to smoothly transition off legacy software without compromising security.

Compare image health between Chainguard Containers and OSS alternatives and track the number of CVEs that Chainguard remediated on your behalf over time.

Proactive malware prevention

Stay protected from malicious attacks often inserted during the build and distribution stages of package creation.

Eliminate vulnerabilities

We don’t just identify OSS vulnerabilities for you to manage – we remove them entirely.

Responsibility you can trust

One reliable, secure partner with industry-leading SLAs to take on the burden of a hard, unpredictable problem.

Thousands of images, with all underlying dependencies rebuilt daily, rapidly growing to meet customer needs

Expertise and experience

The leading open source minds driving the industry forward, delivering new innovations for developers.

The Linux distro powering Chainguard Containers, Libraries, and VMs, designed for agile, secure, and efficient software distribution.

A Better Way to Consume Third-Party Applications

How CVEs slow down developer productivity

Chainguard Image Directory: Get started with CVE-free container images today

FIPS-ing the Un-FIPS-able: Apache Cassandra

Disrupting the Status (Distro)Quo

Kernel-Independent FIPS Images

Why your company is wasting thousands of hours on software vulnerabilities

“Zero-CVE” means that there are no known CVEs at publish time. Chainguard’s minimal design and continuous rebuilds keep CVE counts low, and new advisories are remediated under SLA so you roll forward to clean digests.

FIPS 140-3 : Cryptographic modules validated through NIST's Cryptographic Module Validation Program, required in many regulated environments (e.g., FedRAMP, DoD Impact Levels, etc.).

STIG : Security Technical Implementation Guides. These are DISA hardening baselines we apply at the operating system level.

Use FIPS-validated images and STIG-hardened hosts when your Authority to Operate, contract, or internal policy requires them.

Chainguard accelerates certification and simplifies ongoing compliance with minimal, zero-CVE containers. Our images come with FIPS cryptography, OS-level STIGs, and full SBOMs, with a best-in-class SLA for CVE remediation — these features help satisfy many controls required by these compliance frameworks.

Every Chainguard image ships with Sigstore signatures, a signed SBOM, and SLSA L2 provenance. Auditors or automated continuous integration pipelines can verify authenticity and build provenance using Cosign/Sigstore.

FIPS-validated container variants are available and should be used in environments where validated cryptography is required.

STIG-hardened hosts (Chainguard VMs) are available and should be used where DISA hardening baselines are mandated.

On average, Chainguard images show ~97.6% fewer vulnerabilities than typical alternatives, and ~80% lower CVE accumulation over time.

Chainguard Factory tracks upstream changes, triggers clean rebuilds, then publishes new images with updated SBOMs and provenance, and delivers under SLA. You promote new digests via your normal CI/CD.

Chainguard artifacts are standard OCI images that include signatures, SBOMs, and provenance documentation. Cosign/Sigstore verification works in any environment where your trust roots are accessible. For fully air-gapped environments, specific implementation details depend on your registry configuration and Sigstore trust setup.

Chainguard lets you verify integrity end-to-end by providing container images, libraries, and VMs that are continuously rebuilt from source and shipped with Sigstore signatures, signed SBOMs, and SLSA Level 3 provenance—giving you tamper-evident proof that what you deploy is exactly what was securely built.