Chainguard Checks overview
Learn how Chainguard Checks runs your repository's CI checks in isolated microVMs on every GitHub pull request, with no …
7 min read
Guardener overview
Guardener is a tool for managing and hardening your source code, with a growing suite of capabilities you opt into independently.
3 min read
Guardener is a tool for managing and hardening your source code. Rather than adding a separate integration for every task, Guardener provides a growing suite of capabilities that you opt into independently. Some capabilities run through the Chainguard App, a hardened GitHub App, and are configured per repository through files committed to your codebase; others, such as Dockerfile migration, run locally through chainctl.
Optional Features
Each Guardener capability is an Optional Feature: it stays off until you turn it on. Guardener and its Optional Features are subject to the Guardener and Code Analysis Terms. Under those terms, the offerings are Technology Previews, including the Optional Features in Early Access.
| Optional Feature | What it does | How to turn it on | Stage |
|---|---|---|---|
| Hardened Actions | Recommends hardened, SHA-pinned replacements from Chainguard Actions for your GitHub Actions in pull request review comments and opens migration pull requests on a schedule or on demand. | Add .chainguard/actions.yaml to a repository. | Early Access |
| Container Image Suggestions | Recommends Chainguard container images for the images that a pull request adds or changes, with one-click suggested changes where possible. | Add .chainguard/images.yaml to a repository. | Early Access |
| Container Image Migration | Opens a pull request, on a schedule or on demand, that replaces a repository’s existing container images with Chainguard container images. | Add a migrate block to .chainguard/images.yaml. | Early Access |
| Commit Verification | Checks that an authorized signer signed every commit in a pull request. Supports keyless (Sigstore) signatures and static keys such as GPG. | Add .chainguard/source.yaml to a repository. | Beta |
| Dockerfile migration | Uses AI to iteratively convert your Dockerfiles to use Chainguard Containers. Docker builds run on your machine. | Join the waitlist, then run chainctl agent dockerfile commands. | Beta |
| Agent skill hardening | Hardens the agent skills you upload and reports what changed. | Run chainctl skills harden. | Beta |
| Chainguard Harness | Finds exploitable vulnerabilities in your application code with a frontier AI model and returns fixes a Chainguard engineer has reviewed. | Join the waitlist, then give Chainguard read-only access to your code through the Chainguard App or send a source archive. | Beta |
Chainguard may remove, modify, or add Optional Features over time and will update this table to reflect any such changes.
Chainguard Harness
Chainguard Harness is an Optional Feature of Guardener in Technology Preview, provided under the Code Analysis Terms, located here: https://www.chainguard.dev/legal/code-analysis-terms. Chainguard Harness uses a Restricted Third Party Artificial Intelligence Large Language Model that its third-party provider has designated as a model with heightened safeguards. Customers should review and validate all Code Analysis Outputs before you rely on them or deploy them in your production environment. Use of Chainguard Harness does not guarantee your software, systems, or dependencies are free from vulnerabilities.
Where to start
- GitHub App — Install the app, link your organization, and configure Guardener’s GitHub capabilities (Hardened Actions, Container Image Suggestions, Container Image Migration, and Commit Verification):
- Getting started — Install the Chainguard App and link your Chainguard organization to your GitHub organization.
- Configuration — Understand the
.chainguard/configuration model and how features are enabled per repository.
- Dockerfile migration — Migrate your Dockerfiles to Chainguard Containers using the
chainctl agent dockerfilecommands.
Support
For questions or feedback, contact your Chainguard account team or email support@chainguard.dev.
Last updated: 2026-10-23 22:57