What is Chainguard? The trusted source for open source

What is Chainguard?

Chainguard is a software supply chain security company that rebuilds open source software to be trusted, secure, and effortless to use, and delivers it back to organizations as hardened, trusted, production-ready artifacts. Its mission is to make all open source software trustworthy.

Chainguard’s flagship product is hardened container images, but containers are one product in a platform that now spans three phases of the software development lifecycle: coding safely with AI agents, building with trusted artifacts, and shipping through trusted continuous integration (CI). Nine products cover that arc — Agent Skills, Workspaces, Harness, Containers, Libraries, VMs, OS Packages, Actions, and Checks — all produced by the same build infrastructure and delivered from a single trusted source.

Most security tools detect problems in open source software after you have already pulled it in. Chainguard changes the supply itself. Instead of scanning what you consumed, Chainguard ensures you consume artifacts that were built securely to begin with. These artifacts are minimal by construction, proactively defend against AI attacks, and are shipped with cryptographic proof of how they were made. Chainguard now secures the environments where that code gets written and tested as well, because AI agents have made the development environment itself part of the attack surface.

Chainguard serves 700+ customers, including Anduril, Canva, DocuSign, OpenAI, Public Storage, Snap Inc., and Snowflake. In June 2026, Chainguard was named a Leader in the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security.

The problem: Open source is the attack surface, and AI is expanding it

Open source software makes up over 90% of the code most organizations use. That code is not written by your team, reviewed by your team, or patched on your schedule, but you are accountable for all of it.

Three things have changed recently that make the old approach of scanning and patching open source software in order to consume it untenable at most organizations.

With AI, code is being written faster than it can be secured. AI-assisted development has dramatically accelerated both the amount of code organizations produce and the number of dependencies they pull in. The daily volume of published Common Vulnerabilities and Exposures (CVEs) is up roughly 80% year over year. Vulnerabilities now accrue faster than teams can patch them, leading to a structural backlog that can’t be fixed by staffing.

Attackers also benefit from the same AI tools. Frontier models are now capable of discovering and chaining vulnerabilities in open source projects into working exploits and generating convincing social engineering campaigns against maintainers. Recent supply chain compromises across the npm, PyPI, and Maven ecosystems — Axios, LiteLLM, keyv, cacheable, Shai-Hulud, and others — were not sophisticated in the traditional sense. They were cheap, fast, and effective. In February 2026, hundreds of malicious AI agent skills were found in community registries, directing agents to install credential-harvesting malware.

The development environment itself became a target. When an engineer runs five or six parallel agent sessions, those agents install packages, run arbitrary shell scripts, and edit configurations — on a laptop holding corporate credentials, SSH keys, and production access. CI runners have the same problem: they combine long-lived secrets with untrusted code execution. A single prompt-injected agent or malicious install script can exfiltrate keys from memory.

The conventional response is to add more detection: scanners, dashboards, ticket queues, exception processes. But detection is reactive by definition. A scanner tells you that the thing you already deployed is dangerous. It doesn’t give you a safe alternative, and it doesn’t do the remediation work.

How Chainguard works: Chainguard OS and the Chainguard Factory

Chainguard’s products all sit on top of two pieces of infrastructure the company built itself.

Chainguard OS

Chainguard bootstrapped Chainguard OS, a purpose-built Linux distribution designed for cloud-native workloads. Unlike legacy distributions built around infrequent, monolithic releases, Chainguard OS is architected for continuous integration and delivery with rapid “nano-updates” and rebuilds.

The practical consequence: When the open source community ships a security, functional, or performance fix upstream, Chainguard can capture it and get it to customers in hours rather than waiting for a distribution release cycle. Owning the OS means owning the entire supply chain beneath every artifact — no inherited pre-built binaries, no trust assumptions borrowed from someone else’s build farm.

Chainguard Factory

The Chainguard Factory is the agentic build system that produces every artifact. It is a self-healing pipeline that continuously drives each package toward an ideal state: zero known CVEs, latest version, fully tested.

Unlike a traditional CI/CD pipeline, which runs when someone triggers it, the Factory is built on a reconciler model. It continuously watches upstream open source — registries, repositories, CVE feeds, distribution trackers — compares desired state against actual state, and dispatches specialized bots and AI agents to autonomously close any gap. When a bot gets stuck on something messy, like a patch conflict, it escalates to an AI agent with retry and failure handling. Every artifact the Factory produces carries layers of defense built into it:

• Built from source in an isolated SLSA Level 3 environment with no pre-built binaries that could smuggle in malicious code

• SHA-pinned source inputs, so a compromised maintainer account is detected at ingest

• Sigstore signatures end-to-end, so tampering in transit or in a registry breaks verification

• Complete, build-time-generated Software Bills of Materials (SBOMs), not after-the-fact guesses about contents

• Bitwise reproducibility, with images rebuilt through a separate toolchain to produce equivalent results

• Supervisor/guest separation, isolating privileged orchestration code from untrusted upstream code during builds

This is why Chainguard’s defenses are different in kind: They are properties of the artifact itself rather than a dashboard sitting next to it.

Chainguard’s products

Code safely with agents

Chainguard Agent Skills

Chainguard Agent Skills applies the same principle behind Chainguard’s other products to the newest artifact type in the software supply chain. AI agent skills are executable instructions that agents load and act on. Community skill registries have no built-in vetting or integrity verification — exactly why attackers moved there.

Chainguard offers two things here. A free catalog of 1,000+ hardened public skills, browsable at skills.chainguard.dev, gives teams a secure base to build on. Hardening as a service lets organizations run their own skills through Chainguard’s hardening pipeline and distribute the results org-wide through a private registry with access control and version pinning, or over a Model Context Protocol (MCP) server. Each skill ships with a HARDENING.md report of every rule checked and fix applied, and the pipeline continuously re-evaluates skills as upstream sources change or new rules are added. Agent Skills is currently in beta.

Chainguard Workspaces

Chainguard Workspaces gives engineers and AI agents Chainguard-hardened, microVM-based development environments — the answer to the problem of agents running unconstrained on a laptop full of credentials.

Every Workspace boots as a dedicated microVM with its own kernel rather than a shared-kernel container. The guest image is apko-built from minimal, zero-CVE Chainguard OS Packages, so environments are reproducible, verifiable, and FIPS-compliant if needed. The security model is the important part: no real secrets exist inside the microVM. When an agent makes a network request, a host-side proxy validates it and injects short-lived credentials in flight, and tools that need keys on disk receive encrypted stand-ins that are worthless outside the active session. An optional egress policy blocks and logs any outbound request to an endpoint you have not explicitly allowed, so a compromised dependency cannot phone home and a prompt-injected agent cannot leak source code.

Workspaces is also built for how agents actually work. Environments start and resume in seconds from warm snapshots, restoring the working tree, uncommitted edits, shell, and background processes. Engineers can fan out multiple independent Workspaces from the same repository to let different agents explore competing strategies in parallel. Pre-execution snapshots allow teams to roll back package changes, configurations, and untracked files when a loop goes wrong. When an agent hits a decision above its pay grade, it can route a question to a human instead of guessing, and the Workspace suspends to a snapshot after 10 minutes to halt compute spend until someone answers. Every run produces a tamper-proof record of the environment, commands, code changes, and network calls.

Workspaces supports Claude today, with additional agents planned. It is currently in beta, with 500 free hours per month.

Chainguard Harness

Chainguard Harness points frontier AI at your own application code to find exploitable vulnerabilities, without requiring you to have frontier model access, an in-house harness, or AI security specialists.

Harness builds your application from source exactly as it ships and boots it inside an isolated microVM. Frontier models, including Anthropic’s Claude Mythos 5.1, then actively probe the running application the way an attacker would, working from your source, git history, dependency source, and build configuration. That live-instance approach surfaces the bugs static scanners structurally cannot see: logic flaws, injection, and resource exhaustion.

Two design choices make the output usable. Every finding is proven. Each exploit is replayed in a fresh microVM, and if it does not land every time, it does not make the report. Each recommended fix must also pass the test in reverse: the exploit has to succeed against your current code and fail against the fix. Every fix is human-reviewed by a named Chainguard engineer before it reaches you. If the flaw turns out to be in an open source dependency rather than your own code, Chainguard handles coordinated disclosure with upstream maintainers directly, and the patched build ships through Chainguard Repository.

The containment model mirrors the Factory’s. The hunting phase runs with no network egress and no credentials inside, the agent loop runs outside the sandbox so every command is logged, and the code under test is treated as untrusted data to guard against prompt injection hidden inside it. Harness is currently in beta via waitlist, and is available through the Claude Marketplace by Anthropic, so teams can apply existing Anthropic commitments to it.

Build with trusted artifacts

Chainguard Containers

Chainguard Containers is a catalog of over 3,000 hardened container images for open source projects, rebuilt daily from source in the Chainguard Factory. Images follow a minimal-by-construction philosophy. They are built with only what is needed to run the application, so the default production variants ship without a shell, package manager, or unused utilities to exploit.

The result is zero-CVE images with high-quality SBOMs and verifiable signatures out of the box. Industry-standard SLA commitments for CVE remediation are met by rebuilding from source daily rather than patching binaries, and Chainguard reports roughly 97.6% fewer CVEs than upstream open source equivalents. The catalog includes over 1,200 Federal Information Processing Standards (FIPS) validated container variants, STIG-hardened options, and hundreds of Helm charts.

Containers also support deeper customization and easier adoption: Custom Assembly lets teams add the specific packages they need to a minimal base, Guardener simplifies migration from existing images, and an end-of-life grace period of up to six months gives teams room to upgrade off versions upstream has abandoned.

Chainguard Libraries

Chainguard Libraries is a secure catalog of language dependencies that replaces your team’s direct reliance on npm, PyPI, Maven Central, the Go module proxy, and NuGet. It is the product aimed most directly at the malware problem, because language registries are where malicious packages actually land.

Coverage now spans five ecosystems: Python, Java, JavaScript, Go, and .NET, with Go and .NET newly added in early access. Every package pulled from Chainguard — by an engineer, an agent, or a pipeline — passes through multiple layers of defense. This includes built-from-source rebuilds for high-value targets, plus malware and greyware scanning on everything and configurable cooldown policies that keep brand-new package versions out of your build until they have been observed. It is a malware-resistant endpoint, not another dashboard generating alerts for someone to triage.

The defenses are not theoretical. During the preceding Go and .NET beta, Chainguard’s scanner returned malware verdicts on more than 5,000 .NET and Go packages, and more than 10% of those verdicts had no match in public sources at the time of detection.

CVE remediation is the second half of the product. Chainguard backports critical and high-severity fixes into the older library versions teams are stuck on and cannot upgrade past without a breaking change. Java and Python are generally available, and JavaScript and Go are in beta. Every patched artifact is tested to confirm the CVE is fixed while previously passing functional tests still pass, is reviewed by a Chainguard engineer, and ships with signed SLSA Level 3 provenance and an SBOM in its metadata, so auditors can verify integrity rather than take your word for it.

Chainguard VMs

Chainguard VMs extends the same approach below the container layer: minimal, zero-CVE virtual machine images built entirely from source. The lineup includes trusted container hosts and base and application VM images, available cloud-agnostically and on-prem.

For most organizations, the container host is a maintenance burden nobody wants — patched on a schedule, audited under duress, and rarely a source of differentiation. Chainguard VMs remove that toil while giving the workloads above them a threat-resistant foundation.

Chainguard OS Packages

Chainguard OS Packages gives teams direct access to the 30,000+ zero-CVE packages that power Chainguard Containers, so they can compose bespoke images themselves rather than adopting a pre-built one.

Teams pull from their own private APK repository with tools they already use — Bazel with rules_apko, Melange, plain Dockerfiles — and Chainguard handles CVE remediation, vulnerability monitoring, and continuous package updates underneath. A FIPS variant provides packages built with Chainguard’s FIPS-validated cryptographic modules for teams working against federal compliance requirements.

This is the answer for organizations that want full control over image composition without inheriting package-level remediation work.

Ship through trusted CI

Chainguard Actions

Chainguard Actions is a catalog of 1,000+ continuously hardened, drop-in replacements for third-party GitHub Actions. CI/CD pipelines build, test, and deploy nearly everything an organization ships, and they hold credentials for all of it. However, the third-party actions composing those pipelines have remained largely unprotected, making them a frequent attack vehicle for tag hijacking, dependency confusion, pull_request_target abuse, and secret exfiltration through logs.

Chainguard Factory’s reconciler re-verifies each upstream action whenever a new version ships and re-hardens the entire catalog whenever a new attack pattern is identified, SHA-pinning each one to verified source. Every action includes a hardening report documenting exactly what was mitigated, which is useful for both security review and compliance audits. The Guardener GitHub App handles org-wide rollout, and Chainguard commits to adding requested actions within one business day.

Chainguard Checks

Chainguard Checks turns CI from a queue you wait on into a tool call you can make from anywhere, including from inside an agent loop.

The problem it solves is one Chainguard hit internally while running thousands of autonomous agents alongside human engineers. Agents iterate: write code, run tests, refine. Pushing every iteration through a traditional CI queue wastes compute re-downloading the same dependencies, destroys the agent’s reasoning context during long waits, and leaves a trail of broken commits clogging the pipeline for everyone else.

Checks runs your existing suite inside warm, Chainguard-hardened microVMs built from zero-CVE packages, booting from pre-baked snapshots so dependency installation is paid once in the background rather than on every commit. Engineers trigger it from the chainctl command-line interface or a git pre-commit hook, pull requests run it through the GitHub App, and agents call it through an MCP server or SDKs. Every path runs the same checks and returns the same signed attestation, so merge gates can verify a passing verdict and skip redundant downstream CI runs.

The security model matches Workspaces. Runners hold no credentials on disk or in memory, declarative egress policies deny or destroy on unauthorized outbound connections, and every build dependency is verified against your lockfile before execution.

Paired with Workspaces, Checks becomes a loop-exit gate an agent cannot fake. While checks run, the Workspace suspends to a snapshot and burns zero compute. On failure it resumes in seconds with failure logs injected straight into the live session, so the agent keeps its context and keeps iterating until CI passes. Only a passing verdict lets it open a pull request. Checks is currently in beta, with 500 free hours per month.

Platform

Three capabilities cut across the products. Chainguard Repository is the policy-managed endpoint for artifacts — a single place to pull from, set rules like cooldowns, CVE blocking, and license restrictions, and monitor coverage and enforcement across the environment. 

Chainguard Guardener handles adoption and migration, from swapping base images to rolling hardened actions out org-wide. Chainguard MCP gives AI coding agents four servers for verifying what they are about to recommend: cg-oci confirms an image tag or digest actually exists before it lands in a Dockerfile, cg-apk looks up exact Chainguard package equivalents by name, cg-versions checks whether a version is current or end-of-life, and cg-api verifies organization policy, entitlements, and attestation data. Governance is enforced server-side rather than through prompt guardrails, and the servers work with any MCP-compatible client over standard OAuth. Chainguard MCP is generally available for enterprise customers.

Beyond products: Athena and open source leadership

Chainguard’s ultimate goal is to make the entire open source ecosystem more secure. In June 2026, Chainguard founded and now operates Athena, the industry coalition for the orchestrated defense of open source software. Athena pools pre-disclosure open source vulnerability findings — including those surfaced by frontier AI security programs — and remediates them under embargo, before attackers can act on public disclosure. Members include BNY, Cisco, Cloudflare, Corridor, DepthFirst, Docker, JPMorganChase, Kyndryl, LTIMindtree, and PwC, with Akamai, Black Duck, Cycode, JFrog, Morgan Stanley, Qualys, Upwind, and Zafran joining since.

The time-to-exploit is going negative for a growing share of flaws: exploits increasingly land before a bug is ever publicly disclosed. Athena’s answer is to also make remediation time negative. The coalition has now surfaced more than 21,000 previously hidden zero-day vulnerabilities buried in popular open source projects, and the first wave of disclosures is live, meaning Athena members receive pre-patched artifacts through Chainguard Libraries without having to run an emergency upgrade. Athena also publishes deduplicated, enriched finding metadata as an OSV feed so the wider ecosystem benefits.

Beyond Athena, the Chainguard founding team created several of the most widely adopted open source projects in software supply chain security — Sigstore, Tekton, Knative, and the SLSA framework. The Chainguard team as a whole contributes to over 100 different open source projects, and gives back to the open source community through its EmeritOSS program.

How Chainguard is different

As the market expands, four things continue to separate Chainguard.

Coverage across the whole lifecycle, not one artifact type. No other vendor delivers hardened containers, language libraries across five ecosystems, VMs, OS packages, CI/CD actions, and AI agent skills from a single trusted source, and very few extend that coverage to the environments where agents write and test the code. The Chainguard Repository delivers artifacts through one policy-managed endpoint. It’s a single place to pull artifacts, set rules like upstream fallback and cooldown periods, and monitor coverage and enforcement across the environment.

Defenses in the artifact, calibrated per artifact type. For Containers, VMs, OS Packages, and rebuilt Libraries, that means daily rebuilds from source. For libraries not yet rebuilt, it means upstream fallback with malware and greyware scanning plus configurable cooldowns. For Actions and Agent Skills, it means continuous analysis, hardening, and re-evaluation triggered by upstream change. For Workspaces and Checks, it means hardware-isolated microVMs with host-side credential injection. It’s the same principle, applied with different mechanisms, based on the unique ways these artifact types work.

Speed and proof, backed by commitments. Industry-standard SLAs on container CVE remediation. Built-from-source CVE backports with cryptographic attestations for hard-to-upgrade packages. Signed attestations on every CI run. Human review on every Harness fix and every remediated library. Athena membership for pre-disclosure fixes. In each case, the claim is verifiable rather than just asserted.

Focus and expertise. Chainguard’s founders bring a collective 40+ years of experience in this space, and the company’s sole focus is open source supply chain security. Backed by $892M raised and a 600+ person team, that expertise compounds into things like the Factory, kernel-independent FIPS, and the microVM infrastructure behind Workspaces and Checks.

Chainguard by the numbers

Container catalog figures are updated continuously; see images.chainguard.dev for current counts. Engineering hours saved is modeled from CVEs remediated at an average of four hours per CVE.

Start with trusted open source

Open source will remain central to how software gets built, and AI is not going to slow down. The organizations handling this well have stopped trying to inspect their way out of the problem and changed what they consume — and increasingly, where they let their agents run.

Browse the catalog at images.chainguard.dev, or talk to an expert about where Chainguard fits in your stack.