Build software securely with Chainguard
Starter
Access to Chainguard for small projects, no credit card required.
Limited access to:
- Containers
- Libraries
- Actions
- Workspaces
- Checks
- Agent Skills
- Guardener
Team
Popular
Higher usage limits and functionality for teams, paid via credit card.
Everything in Starter, plus:
- Unlimited users
- 1TB image download
- 1M dependency pulls
- Support
- Managed policies
Enterprise
Enterprise security, compliance, and controls built for scale.
Everything in Team, plus:
- Unlimited usage
- Harness
- FIPS catalog
- SSO and SCIM
- Audit logs
- Contractual SLAs
- Enterprise support
Trusted artifacts
Chainguard Containers
3,000+ container image catalogAccess to minimal, near-zero CVE container images built from source.
Select up to 5
Select up to 5 with all supported versions limited catalog access
Complete catalog with all supported versions
1,300+ FIPS image catalogFIPS-compliant versions of Chainguard Containers for regulated and government workloads.
Image swaps per monthExchange one of your selected images for a different one. Swaps reset on a rolling 30-day window.
0
1
Unlimited
Monthly image downloadsTotal compressed data transferred when developers, servers, or external CI/CD pipelines pull images from Chainguard.
100 GB
1 TB
Unlimited
Helm charts200+ Helm charts that deploy Chainguard Containers out of the box.
For your 5 images
For all included images
All
Custom AssemblyAdd your own packages, certificates, and configuration to Chainguard images, built and maintained by Chainguard.
OS PackagesHardened APK packages for extending Chainguard Containers or building your own images.
Public packages
Public packages
All
FIPS-validated OS PackagesFIPS-validated, hardened APK packages for extending Chainguard Containers or building your own images.
Commercial buildsAccess to hardened versions of third-party, licensed images such as those from GitLab, Elastic, and F5 NGINX.
Policy managementCreate configurable rules based on image release age, license, support window, and end of life.
SLSA L3 provenanceAccess to signed attestations for every container image.
SBOMsAccess to software bill of materials for every container image.
Chainguard Libraries
Available language ecosystemsLanguage ecosystems available for consumption.
JavaScript, Python, Java, Go, .NET
JavaScript, Python, Java, Go, .NET
JavaScript, Python, Java, Go, .NET
Malware- and greyware-scanned dependenciesPre-screened packages evaluated across 24+ behavioral signals and 200+ threat rules.
Backported CVE and zero-day patchesAccess to backported CVE fixes for versions your team's stuck on. Zero-day patches available on disclosure day, powered by Athena.
5 remediated versions
Unlimited
Dependency pulls per monthMaximum number of unique package-versions available for download each month.
50,000
1,000,000
Unlimited
Version cooldownsPolicy to prevent package downloads that do not meet the designated release age.
Fixed 7 days
Flexible 0-7 days
Fully configurable
SLSA L3 provenanceAccess to signed attestations for every Chainguard-built package.
SBOMsAccess to software bill of materials for every Chainguard-built package.
Chainguard Actions
1,000+ hardened actions catalogAccess 1000+ continuously hardened drop-in replacements for GitHub Actions.
60,000 mins / 1,000 hours
Custom
1-day actions hardeningGet additional actions added to the catalog in one business day.
Hardening reportsVerify hardening with reports that show vulnerabilities found and removed.
Chainguard Skills
1,000+ hardened skills catalogUse hardened, community-built agent skills.
Hardening reportsVerify hardening with reports that show vulnerabilities found and removed.
Offensive AI security
Chainguard Harness
First-party code analysisReceive vulnerabilities and recommended fixes for vulnerabilities discovered in your first-party code.
Third-party code analysisReceive vulnerabilities and recommended fixes for vulnerabilities in open source dependencies.
Reproducible vulnerability reportReceive a markdown report with an executive summary, vulnerabilities, and recommended fixes across the scanned repository.
Upstream maintainer disclosure managementChainguard manages responsible upstream disclosure to maintainers when vulnerabilities are discovered.
Secure agentic development
Chainguard Checks
Hardened CI runnersRun CI workflows in Chainguard-hardened, hosted microVMs.
500 vCPU hours
1,000 vCPU hours
Custom
Default-deny network egressDenies egress or destroys runner instances when unapproved endpoint access is attempted.
Host-side credential proxyingCredentials never enter the CI runner and are proxied.
Chainguard Workspaces
Hardened sandbox computeSandbox agent execution in Chainguard-hardened, hosted microVMs
500 vCPU hours
1,000 vCPU hours
Custom
Configurable network egress policiesConfigurable deny/destroy network policies to prevent unapproved agent network access.
Host-side credential proxyingCredentials never enter the Workspace and are proxied.
Registry integrationWorkspaces connect to your registry so agents only pull trusted dependencies.
Chainguard Checks integrationCall Checks from within Workspaces for pre-commit validation.
Governance
Chainguard Repository
Third-party repository mirroringMirror Chainguard artifacts to JFrog Artifactory, Sonatype Nexus Repository, and other third-party repositories you already use.
Private artifact storageStorage for private uploaded artifacts, such as container images, language libraries, and skills. Chainguard-built artifacts do not count toward your limit.
10 GB
50 GB
Custom
Custom policiesSet your own rules for what can be pulled and blocked
Audit logA record of who did what in your account and when, so you can review activity and support audits
Migration & adoption
Guardener
Actions and container image auditSee the actions and container images in use across your organization.
Automated migration of CI/CD actionsMigrate with automatically generated PRs that replace community-built uses: references upfront and on schedule.
Automated container image migrationMigrate to Chainguard Containers with automatically generated PRs that replace image references upfront and on schedule.
First-party agent skill hardeningHarden private agent skills.
1M shared tokens
5M shared tokens
Custom
Admin
Support
Product supportHelp from our team with product questions.
Ticketed
Custom
Response SLAGuaranteed maximum time for first support reply.
Custom
Identity
UsersMaximum number of developers with access to account configuration.
5
Unlimited
Unlimited
SSOSingle sign-on with your company identity provider.
SCIMStandard protocol for automated user provisioning.