What is Chainguard? The trusted source for open source

What is Chainguard?

Chainguard is a software supply chain security company that rebuilds open source software to be trusted, secure, and effortless to use, and delivers it back to organizations as hardened, trusted, production-ready artifacts. Its mission is to make all open source software trustworthy.

Chainguard’s flagship product is hardened container images, but containers are one of six artifact types it secures. Today, Chainguard covers containers, language libraries, virtual machine images, OS packages, CI/CD workflows, and AI agent skills — six of the most widely used open source artifact types in the modern software development lifecycle, all delivered from a single trusted source.

Most security tools detect problems in open source software after you have already pulled it in. Chainguard changes the supply itself. Instead of scanning what you consumed, Chainguard ensures you consume artifacts that were built securely to begin with. These artifacts are minimal by construction, proactively defend against AI attacks, and are shipped with cryptographic proof of how they were made.

Chainguard serves 700+ customers, including Anduril, Canva, DocuSign, OpenAI, Public Storage, Snap Inc., and Snowflake. In June 2026, Chainguard was named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security.

The problem: Open source is the attack surface, and AI is expanding it

Open source software makes up over 90% of the code most organizations use. That code is not written by your team, reviewed by your team, or patched on your schedule, but you are accountable for all of it.

Two things have changed recently that make the old approach of scanning and patching open source software in order to consume it at most organizations untenable.

With AI, code is being written faster than it can be secured. AI-assisted development has dramatically accelerated both the amount of code organizations produce and the number of dependencies they pull in. Every new dependency is a new attack surface. Vulnerabilities now accrue faster than teams can patch them, leading to a structural backlog that can’t be fixed by staffing.

Attackers also benefit from the same AI tools. Frontier models are now capable of discovering and chaining vulnerabilities in open source projects into working exploits and generating convincing social engineering campaigns against maintainers. Recent supply chain compromises across the npm, PyPI, and Maven ecosystems — Axios, LiteLLM, keyv, cacheable, and others — were not sophisticated in the traditional sense. They were cheap, fast, and effective. In February 2026, hundreds of malicious AI agent skills were found in community registries, directing agents to install credential-harvesting malware.

The conventional response is to add more detection: scanners, dashboards, ticket queues, exception processes. But detection is reactive by definition. A scanner tells you that the thing you already deployed is dangerous. It doesn’t give you a safe alternative, and it doesn’t do the remediation work.

How Chainguard works: Chainguard OS and the Chainguard Factory

Chainguard’s products all sit on top of two pieces of infrastructure the company built itself.

Chainguard OS

Chainguard bootstrapped Chainguard OS, a purpose-built Linux distribution designed for cloud-native workloads. Unlike legacy distributions built around infrequent, monolithic releases, Chainguard OS is architected for continuous integration and delivery with rapid “nano-updates” and rebuilds.

The practical consequence: When the open source community ships a security, functional, or performance fix upstream, Chainguard can capture it and get it to customers in hours rather than waiting for a distribution release cycle. Owning the OS means owning the entire supply chain beneath every artifact — no inherited pre-built binaries, no trust assumptions borrowed from someone else’s build farm.

Chainguard Factory

The Chainguard Factory is the agentic build system that produces every artifact. It is a self-healing pipeline that continuously drives each package toward an ideal state: zero known Common Vulnerabilities and Exposures (CVEs), latest version, fully tested.

Unlike a traditional CI/CD pipeline, which runs when someone triggers it, the Factory is built on a reconciler model. It continuously watches upstream open source — registries, repositories, CVE feeds, distribution trackers — compares desired state against actual state, and dispatches specialized bots and AI agents to autonomously close any gap. When a bot gets stuck on something messy, like a patch conflict, it escalates to an AI agent with retry and failure handling.

Every artifact the Factory produces carries layers of defense built into it:

• Built from source in an isolated SLSA Level 3 environment with no pre-built binaries that could smuggle in malicious code

• SHA-pinned source inputs, so a compromised maintainer account is detected at ingest

• Sigstore signatures end-to-end, so tampering in transit or in a registry breaks verification

• Complete, build-time-generated Software Bills of Materials (SBOMs), not after-the-fact guesses about contents

• Bitwise reproducibility, with images rebuilt through a separate toolchain to produce equivalent results

• Supervisor/guest separation, isolating privileged orchestration code from untrusted upstream code during builds

This is why Chainguard’s defenses are different in kind: They are properties of the artifact itself rather than a dashboard sitting next to it.

Chainguard’s products

Chainguard provides trusted open source artifacts for every layer of your modern software stack:

Chainguard Containers

Chainguard Containers is a catalog of over 3,000 repositories for open source projects, rebuilt daily from source in the Chainguard Factory. Images follow a minimal-by-construction philosophy. They are built with only what is needed to run the application, so the default production variants ship without a shell, package manager, or unused utilities to exploit.

The result is zero-CVE images with high-quality SBOMs and verifiable signatures out of the box. Industry-standard SLA commitments for CVE remediation (7 days for critical, 14 days for high) are met by rebuilding from source daily rather than patching binaries. The catalog includes 1,200+ Federal Information Processing Standards (FIPS) container repositories and 312,000+ tagged versions.

Containers also support deeper customization and easier adoption: Custom Assembly lets teams add the specific packages they need to a minimal base, Guardener simplifies migration from existing images, and hundreds of Helm charts ship with secure-by-default images built in.

Chainguard Libraries

Chainguard Libraries is a secure catalog of language dependencies that replaces your team’s direct reliance on npm, PyPI, and Maven Central. It is the product aimed most directly at the malware problem, because language registries are where malicious packages actually land.

Every package pulled from Chainguard — by an engineer or an AI agent — passes through multiple layers of defense. This includes built-from-source rebuilds, where available, plus malware and greyware scanning and configurable cooldown policies that keep brand-new package versions out of your build until they have been observed. It is a malware-resistant endpoint, not another dashboard generating alerts for someone to triage.

The catalog covers Python (PyPI), Java (Maven), and JavaScript (npm), with additional ecosystems in development based on customer demand. Chainguard also backports fixes for critical and high-severity CVEs in Java and Python versions that teams are stuck on and cannot upgrade past. Every remediation is built from source and carries SLSA Level 3 provenance and an SBOM inside the artifact itself — verifiable proof for auditors, rather than an unverifiable runtime patch.

Chainguard VMs

Chainguard VMs extends the same approach below the container layer: minimal, zero-CVE virtual machine images built entirely from source. The lineup includes trusted container hosts and base and application VM images, available cloud-agnostically and on-prem.

For most organizations, the container host is a maintenance burden nobody wants — patched on a schedule, audited under duress, and rarely a source of differentiation. Chainguard VMs remove that toil while giving the workloads above them a threat-resistant foundation.

Chainguard OS Packages

Chainguard OS Packages gives teams direct access to the 30,000+ zero-CVE packages that power Chainguard Containers, so they can compose bespoke images themselves rather than adopting a pre-built one.

Teams pull from their own private APK repository with tools they already use — Bazel with rules_apko, Melange, plain Dockerfiles — and Chainguard handles CVE remediation, vulnerability monitoring, and continuous package updates underneath. A FIPS variant provides packages built with Chainguard’s FIPS-validated cryptographic modules for teams working against federal compliance requirements.

This is the answer for organizations that want full control over image composition without inheriting package-level remediation work.

Chainguard Actions

Chainguard Actions is a catalog of over 800 continuously hardened GitHub Actions, currently in beta. CI/CD pipelines build, test, and deploy nearly everything an organization ships, and they hold credentials for all of it. However, the third-party actions composing those pipelines have remained largely unprotected, making them a frequent attack vehicle.

Chainguard Factory’s reconciler re-verifies each upstream action whenever a new version ships and re-hardens the entire catalog whenever a new attack pattern is identified. The process removes script injections, unsafe credential handling, and other vulnerabilities, producing safe drop-in replacements for upstream actions. Every action includes a hardening report documenting exactly what was mitigated, which is useful for both security review and compliance audits.

Chainguard Agent Skills

Chainguard Agent Skills applies the same principle behind Chainguard’s other products to the newest artifact type in the software supply chain. AI agent skills are executable instructions that agents load and act on. Community skill registries have no built-in vetting or integrity verification — exactly why attackers moved there.

Chainguard offers two things here. A free repository of 1,000+ hardened community skills gives teams a secure base to build on. Hardening as a service lets organizations run their own skills through Chainguard’s hardening pipeline and distribute the results org-wide over an MCP server; each skill ships with a HARDENING.md report of every rule checked and fix applied, and the pipeline continuously re-evaluates skills as upstream sources change or new rules are added. Agent Skills is currently in closed beta.

For engineers, adoption requires no new toolchain or configuration.

Beyond products: Athena and open source leadership

Chainguard’s ultimate goal is to make the entire open source ecosystem more secure. In June 2026, Chainguard founded and now operates Athena, the industry coalition for the orchestrated defense of open source software. Athena pools pre-disclosure open source vulnerability findings — including those surfaced by frontier AI security programs — and remediates them under embargo, before attackers can act on public disclosure. Founding members include BNY, Cisco, Cloudflare, Corridor, DepthFirst, Docker, JPMorganChase, Kyndryl, LTIMindtree, and PwC, with Akamai, Black Duck, Cycode, JFrog, Morgan Stanley, Qualys, Upwind, and Zafran joining since.

The time-to-exploit is going negative for a growing share of flaws: exploits increasingly land before a bug is ever publicly disclosed. Athena’s answer is to also make remediation time negative. Members receive backported fixes ahead of disclosure through Chainguard Libraries, and Athena publishes deduplicated, enriched finding metadata as an OSV feed so the wider ecosystem benefits.

Beyond Athena, the Chainguard founding team created several of the most widely adopted open source projects in software supply chain security — Sigstore, Tekton, Knative, and the SLSA framework. The Chainguard team as a whole contributes to over 100 different open source projects, and gives back to the open source community through its EmeritOSS program.

How Chainguard is different

As the market expands, four things continue to separate Chainguard.

Breadth across every artifact type. Chainguard is the only vendor covering containers, libraries, VMs, CI/CD workflows, and AI agent skills from a single trusted source — along with the 30,000+ OS packages underneath them. The Chainguard Repository delivers Containers and Libraries  artifacts through one policy-managed endpoint. It’s a single place to pull artifacts, set rules like upstream fallback and cooldown periods, and monitor coverage and enforcement across the environment.

Defenses in the artifact, calibrated per artifact type. For Containers, VMs, OS Packages, and rebuilt Libraries, that means daily rebuilds from source. For libraries not yet rebuilt, it means upstream fallback with malware and greyware scanning plus configurable cooldowns. For Actions and Agent Skills, it means continuous analysis, hardening, and re-evaluation triggered by upstream change. It’s the same principle, applied with different mechanisms, based on the unique ways these artifact types work.

Speed and proof, backed by commitments. Industry-standard SLAs on container CVE remediation. Built-from-source CVE backports with cryptographic attestations for hard-to-upgrade packages. Athena membership for pre-disclosure fixes. In each case, the claim is verifiable rather than just asserted.

Focus and expertise. Chainguard’s founders bring a collective 40+ years of experience in this space, and the company’s sole focus is open source supply chain security. Backed by $892M raised and a 600+ person team, that expertise compounds into things like the Factory and kernel-independent FIPS.

Chainguard by the numbers

Container catalog figures are updated continuously; see images.chainguard.dev for current counts. Engineering hours saved is modeled from CVEs remediated at an average of four hours per CVE.

Start with trusted open source

Open source will remain central to how software gets built, and AI is not going to slow down. The organizations handling this well have stopped trying to inspect their way out of the problem and changed what they consume instead.

Browse the catalog at images.chainguard.dev, or talk to an expert about where Chainguard fits in your stack.