Chainguard Catalog Starter

Chainguard Catalog Starter is a way to try production-grade Chainguard Containers for free, without committing to a full subscription. It lets you choose a set of five container images from the broader Chainguard catalog so you can validate security, performance, and operational fit in your own environment before you buy.

Note: Chainguard Catalog Starter is in beta.

To sign up for Catalog Starter, follow the steps on this page. Once set up, you can start piloting up to five secure container images from the Chainguard catalog.

What is Catalog Starter?

With Chainguard Catalog Starter, users can choose any five non-FIPS images from our catalog of secure-by-default containers. Any Helm charts that depend on those images are included and count toward the five-image limit.

Catalog Starter is designed as a standalone free plan, separate from paid Catalog or per-image subscriptions. It’s meant for teams who want to try Chainguard Containers in real workloads before committing to a larger rollout, giving them a better understanding of how Chainguard’s hardened images and CVE posture behave in practice.

Note: Catalog Starter is best suited for small teams to get them started right away. When you are ready to standardize on Chainguard and deploy organization-wide, we have several paid plans that provide unlimited user access to the Chainguard Containers and additional features like Custom Assembly, FIPS images, EOL/EmeritOSS image versions, a contractual CVE-remediation SLA, and dedicated support.

Sign up for Catalog Starter

1. Sign up and select your images

1. Go to console.chainguard.dev/signup.
2. Enter your business email address and create an account, or click Continue with Google and sign in with a Google account on your company’s domain. Catalog Starter requires a corporate email domain, so a personal email address, such as a Gmail address, doesn’t qualify.
3. Enter your company name.
4. Click Set up an organization.
5. Complete the form and click Submit.
6. Click Select images, choose between one and five images, and confirm your selection. You can also go to the Images page later to add images until you have five. Once you confirm an image, it can’t be swapped or replaced for the life of the free plan.

Once you’ve added all five images, a prompt directs you to contact Chainguard if you need access to additional images.

2. Integrate with your registry and pipelines

After you complete signup, you’re free to use the five images you selected however you like. For example, you can pull them into your CI/CD pipelines and runtime environments, or pull them through a third-party registry like JFrog Artifactory. These container images are the same as those provided to Chainguard’s paying customers, and are covered by Chainguard’s standard hardening, rebuild, and CVE-remediation processes, although they are not covered by Chainguard’s CVE SLA.

Authenticate CI pipelines with a pull token

Because Catalog Starter organizations can’t create assumable identities, CI pipelines authenticate with a pull token. Create one with chainctl:

chainctl auth pull-token create --output=env

This sets CHAINGUARD_IDENTITY_ID to the username and CHAINGUARD_TOKEN to the password. Store both as secrets in your CI platform, then log in to cgr.dev with them. For example, in a GitHub Actions workflow:

name: Pull a Chainguard container

on:
  push:
    branches: ['main']

permissions:
  contents: read

jobs:
  pull:
    runs-on: ubuntu-latest
    steps:
      - name: Log in to cgr.dev
        env:
          CHAINGUARD_IDENTITY_ID: ${{ secrets.CHAINGUARD_IDENTITY_ID }}
          CHAINGUARD_TOKEN: ${{ secrets.CHAINGUARD_TOKEN }}
        run: |
          echo "$CHAINGUARD_TOKEN" | docker login cgr.dev \
            --username "$CHAINGUARD_IDENTITY_ID" --password-stdin
      - run: docker pull cgr.dev/$ORGANIZATION/python:latest

This workflow doesn’t need the id-token: write permission, because it federates no OIDC token.

Pull tokens expire. The default lifetime is 30 days and the maximum is one year (--ttl=8760h), so rotate the secret before it expires. Refer to Authenticate to Chainguard’s Registry for the rest of the pull token options.

3. Upgrade when you’re ready

After trying out Chainguard Containers with Catalog Starter, you can reach out to our sales team to upgrade to one of Chainguard’s paid plans:

• Catalog pricing — a subscription that grants broad access to the full Chainguard Containers catalog with self-service provisioning through the Console.
• Per-image pricing — a scoped set of images licensed individually, often used for tightly defined image deployments.

Moving to a paid plan means moving off Catalog Starter; the free five-image entitlement is not stacked on top of a paid subscription.

Manage Catalog Starter with chainctl

As an alternative to the Console, you can sign up for and manage Catalog Starter from the command line with chainctl.

Sign up with chainctl

To sign up for a new account, run the interactive chainctl starter init command:

chainctl starter init

This requires selection of a valid authentication option:

    Choose an identity provider to login to Chainguard

  > Email and password
    Google
    GitHub
    GitLab

Use the arrow keys and press Enter to select an option, which launches a browser window to the Chainguard Console to complete sign-up. A GitHub sign-in must use your GitHub account’s verified primary email address, and that address must be a business email address.

Request access with chainctl

If your organization already has a Catalog Starter plan, request access to it with chainctl starter request-access:

chainctl starter request-access

Add images with chainctl

You can see which images are available using the Chainguard Directory. To add one or more images, run chainctl starter add-images, substituting the desired image names for the variables:

chainctl starter add-images $IMAGE1 [$IMAGE2] ... [$IMAGE4]

After the Chainguard system has processed your request, the images become accessible. This can take up to a few hours. When available, you can pull the images like this, replacing $ORGANIZATION with your organization’s name and $IMAGE with the desired image’s name:

docker pull cgr.dev/$ORGANIZATION/$IMAGE:latest

Check status with chainctl

To show the status of your Catalog Starter organization, including the registry path, account provisioning status, image quota usage, and per-image readiness, run chainctl starter status:

chainctl starter status

Plan limitations and terms

Catalog Starter allows users to try out Chainguard Containers, but it comes with certain limitations, including the following:

• You can select up to five non-FIPS images. Once chosen, these images cannot be swapped or replaced during the lifetime of the free plan.
• The following types of Chainguard Containers are not included in the Catalog Starter plan:
  • FIPS-validated images
  • Images that fall under the EOL grace period
  • Images whose software is part of Chainguard EmeritOSS
• Teams using Chainguard Catalog Starter will not have access to the support services available to paying customers: they will not be added to Chainguard’s support platform, be able to create support tickets, or have access to root cause analysis (RCA).
  • Catalog Starter users will still have access to Chainguard resources like our documentation, courses, the Community Slack channel, and the public support knowledge base.
• Chainguard’s CVE SLA does not apply to container images obtained through Catalog Starter.
• User management is limited. You can invite colleagues and remove members, but you can’t create role-bindings, so you can’t grant custom roles. An invite can give only a role whose permissions you also have. Everyone in your organization uses the same five images.
• The user who creates a Catalog Starter organization gets the limited_owner role, which lets them browse the Console, pull images, create pull tokens, invite colleagues whose email address is in your organization’s domain or one of its subdomains, and remove members. It doesn’t include access to features like Custom Assembly.
• You can create pull tokens, but not assumable identities. A pull token is the only credential a Catalog Starter organization can issue for automation. If you try to create any other identity, the request fails with starter organizations are not allowed to create identities.
• The setup-chainctl GitHub Action doesn’t work with Catalog Starter. It authenticates by assuming a Chainguard identity with the OIDC token GitHub issues to the workflow, and it has no pull token mode. The same applies to the OIDC federation examples for GitLab, CircleCI, Buildkite, Jenkins, and Kubernetes. Authenticate your pipelines with a pull token instead, as described in Authenticate CI pipelines with a pull token.
• Revoking a pull token takes a different path. On the Console’s Pull tokens page, the Delete and Edit actions are unavailable, and chainctl iam identity delete fails, because the limited_owner role can’t delete identities. To revoke a token, delete its role binding instead: run chainctl iam role-bindings list to find the binding, then chainctl iam role-bindings delete <role-binding-id>. This removes the token’s access, although the identity itself remains in the list.
• Neither Custom Assembly nor Commercial Builds, Chainguard’s bespoke paid build services, are included in the Catalog Starter plan.
• Catalog Starter cannot be combined with an existing Chainguard Containers license. Existing customers remain on their current paid plans; this free offering can’t be used to subsidize or partially offset paid image counts.

Frequently asked questions

Can I change my five images after I select them?

No. Once you’ve selected your five images under Catalog Starter, that selection is fixed for the life of the free plan and cannot be swapped or replaced.

If you anticipate needing different images over time, we recommend talking to our team about Catalog Pricing or per-image licensing.

Does Catalog Starter include FIPS images or Chainguard commercial builds?

No. FIPS images and Chainguard Commercial Builds are not included in the Catalog Starter plan.

If you require FIPS-validated images or dedicated commercial build work, you’ll need a paid plan that includes those capabilities.

Can I use Chainguard’s GitHub Action with Catalog Starter?

No. The setup-chainctl action federates a GitHub OIDC token into a Chainguard assumable identity, and Catalog Starter organizations can’t create assumable identities. Log in to cgr.dev with a pull token instead, as described in Authenticate CI pipelines with a pull token.

Can my colleagues and I use the same Catalog Starter images?

Yes. Everyone in a Catalog Starter organization uses the same five images, and no one can swap them.

Anyone with the limited_owner role can invite a colleague whose email address is in the organization’s domain or one of its subdomains. The viewer role is enough to pull images. Replace $ORGANIZATION with your organization’s name and $EMAIL with your colleague’s email address:

chainctl iam invite create $ORGANIZATION --role viewer --email $EMAIL

To let your colleague invite others too, use --role limited_owner instead. That role also manages your organization’s billing.

If a Catalog Starter organization already exists for your email domain, you can also ask to join it. In the Console, click Request access, or run chainctl starter request-access. The request goes by email to everyone with the owner or limited_owner role in the organization. The link in that email invites you with the viewer role.

I’m already a Chainguard Containers customer. Can I add Catalog Starter to my account?

No. Catalog Starter is a distinct, standalone free plan meant for new organizations. It can’t be combined with existing licenses or used to “carve out” a subset of images from a current subscription.

If you try to sign up using an email domain already associated with a paid Chainguard account, you’ll receive an error message. Contact your Chainguard account administrator for access to your organization’s existing account.

Can I use Catalog Starter to cover some of the images I need?

No. Catalog Starter is not a discount instrument for larger deployments. You can’t, for example, license 10 images but expect to pay for only five by applying this plan to the rest.

If you know you’ll need more than five images, it’s usually better to start with Catalog Pricing or per-image licensing so you can scale cleanly.

Can I sign up with Google or GitHub?

You can sign up with a Google account on your company’s domain, such as a Google Workspace account. A personal Google account, such as a Gmail address, doesn’t qualify, because Catalog Starter requires a business email address.

The Console’s sign-up page doesn’t offer GitHub. To sign up with GitHub, run chainctl starter init, as described in Sign up with chainctl. Your GitHub account’s verified primary email address must be a business email address.

What happens if I decide to upgrade to a paid plan?

When you upgrade:

• Your organization moves off the free Catalog Starter plan.
• You gain access to the broader capabilities of your chosen paid tier (for example, full Catalog Pricing with self-service provisioning and, optionally, FIPS access), as well as Chainguard’s full support services and CVE SLA.
• Pricing is based on the paid plan’s terms (such as developer bands for Catalog Pricing or image counts for per-image plans).

Our team will work with you to map your existing Catalog Starter images into the right long-term structure.