Chainguard Containers

Chainguard is a software supply-chain security company that provides trusted open-source artifacts for containers, language libraries, VM images, CI/CD actions, and AI agent skills. Its artifacts are rebuilt from source, include verified manifests, provenance and software bills of materials, and are designed to replace vulnerable or malicious public packages. Chainguard also offers CVE backports, hardened actions and community skills, sandbox-based package analysis for suspicious behavior, Helm charts, and an agent called Guardener. Its container service includes rapid remediation commitments, including a one-day SLA for known exploited vulnerabilities; the videos also describe a minimal rolling Linux distribution with 1-, 7-, and 14-day remediation SLAs. The company is associated with the creators of Kubernetes, Sigstore, SLSA, and Google Distroless.

Chainguard Actions are hardened, drop-in replacements for GitHub Actions CI/CD steps. They are designed to protect CI/CD pipelines and privileged code from supply-chain risks; Chainguard's site describes a catalog of more than 1,000 CI/CD actions as part of its trusted open-source artifact offerings.

Chainguard Libraries is a trusted catalog of language dependencies for Python, Java, JavaScript, Go, and .NET. It provides replacement repositories for public package registries such as PyPI, npm, and Maven Central; Chainguard takes upstream source, builds and scans the resulting artifacts, and serves them for use instead of relying on live access to public registries. Chainguard says its packages are detonated in a sandbox to identify suspicious behavior and are supplied as hardened artifacts intended to reduce malware and vulnerability risk in software dependencies. The service is developed and hosted by Chainguard.

Wolfi is Chainguard's minimal, rolling-release Linux distribution, built from the ground up for software supply-chain security. It follows upstream code closely, with Chainguard rebuilding its images frequently rather than maintaining long-lived stable versions. Wolfi is part of Chainguard's broader catalog of trusted open-source artifacts and container images, which the company says are rebuilt from source daily and supplied with provenance verification and software bills of materials.

Chainguard Agent Skills is a Chainguard service for distributing hardened versions of third-party AI-agent skills. Chainguard processes upstream skills through deterministic and agentic hardening steps; organizations can also submit their own skills for hardening and internal sharing. Chainguard’s homepage describes the offering as a collection of more than 1,000 hardened community skills intended to protect against malicious instructions.