Hardened Container Images

“Zero-CVE” means that there are no known CVEs at publish time. Chainguard’s minimal design and continuous rebuilds keep CVE counts low, and new advisories are remediated under SLA so you roll forward to clean digests.

FIPS 140-3: Cryptographic modules validated through NIST's Cryptographic Module Validation Program, required in many regulated environments (e.g., FedRAMP, DoD Impact Levels, etc.).

STIG: Security Technical Implementation Guides. These are DISA hardening baselines we apply at the operating system level.

Use FIPS-validated images and STIG-hardened hosts when your Authority to Operate, contract, or internal policy requires them.

Chainguard accelerates certification and simplifies ongoing compliance with minimal, zero-CVE containers. Our images come with FIPS cryptography, OS-level STIGs, and full SBOMs, with a best-in-class SLA for CVE remediation — these features help satisfy many controls required by these compliance frameworks.

Every Chainguard image ships with Sigstore signatures, a signed SBOM, and SLSA L2 provenance. Auditors or automated continuous integration pipelines can verify authenticity and build provenance using Cosign/Sigstore.

FIPS-validated container variants are available and should be used in environments where validated cryptography is required.

STIG-hardened hosts (Chainguard VMs) are available and should be used where DISA hardening baselines are mandated.

On average, Chainguard images show ~97.6% fewer vulnerabilities than typical alternatives, and ~80% lower CVE accumulation over time.

Chainguard Factory tracks upstream changes, triggers clean rebuilds, then publishes new images with updated SBOMs and provenance, and delivers under SLA. You promote new digests via your normal CI/CD.

Chainguard artifacts are standard OCI images that include signatures, SBOMs, and provenance documentation. Cosign/Sigstore verification works in any environment where your trust roots are accessible. For fully air-gapped environments, specific implementation details depend on your registry configuration and Sigstore trust setup.

Chainguard lets you verify integrity end-to-end by providing container images, libraries, and VMs that are continuously rebuilt from source and shipped with Sigstore signatures, signed SBOMs, and SLSA Level 3 provenance—giving you tamper-evident proof that what you deploy is exactly what was securely built.