Chainguard

Chainguard Enforce

Chainguard

Chainguard Enforce is a software supply chain security platform designed to protect cloud-native environments, particularly Kubernetes workloads. It enables organizations to define, observe, and enforce security policies to ensure that only trusted and compliant container images are deployed into production. The platform provides a centralized control plane for managing security policies across multi-cluster environments, integrating with popular CI/CD systems to verify the integrity and provenance of software artifacts. Key use cases include preventing the deployment of vulnerable or unsigned images, ensuring compliance with security frameworks like SLSA and NIST SSDF, and providing a real-time inventory of software assets. Chainguard Enforce is targeted at security engineers, platform engineers, and CISOs who are responsible for securing the software development lifecycle and mitigating supply chain risks. It is offered as a SaaS platform and can be deployed in an agent-based or agentless mode.

Chainguard OS

Chainguard

Chainguard OS is a minimalist, security-hardened Linux-based operating system designed from the ground up to be the foundation for Chainguard's secure container images. It is not a general-purpose OS but is specifically engineered for cloud-native and containerized workloads, focusing on minimizing attack surfaces and securing the software supply chain. Its core design principles include creating minimal, hardened, and immutable artifacts, ensuring that images contain only an application and its essential runtime dependencies. Rather than traditional patching, Chainguard OS employs an atomic replacement model, where the entire OS is replaced with a new, verified version for updates, eliminating patching errors and ensuring system integrity. This approach, combined with continuous integration and daily rebuilds, allows for rapid remediation of vulnerabilities, often resulting in images with zero known CVEs. It is built for enterprise use cases where security, compliance, and supply chain integrity are critical.

Chainguard VMs

Chainguard

Chainguard VMs are minimal, purpose-built, and hardened virtual machine images designed to provide a secure foundation for cloud and on-premise workloads. Unlike traditional VMs, they are built from source, contain only essential packages, and are continuously updated to maintain a zero-known-vulnerability (zero-CVE) state. This minimalist approach significantly reduces the attack surface, improving boot and runtime security against threats like privilege escalation and kernel exploits. Chainguard offers different VM types, including Container Hosts for running containerized applications, Application VMs pre-packaged with services like Nginx or Jenkins, and Base VMs for custom application deployment. The product is aimed at platform engineers, DevOps teams, and security professionals looking to reduce the operational overhead of patching, streamline compliance with standards like FedRAMP and PCI DSS, and enhance their overall security posture in multi-cloud and hybrid environments.

Chainguard Libraries

Chainguard

Chainguard Libraries is a software supply chain security solution that provides developers with a secure and trusted source for open-source language dependencies. It offers a catalog of popular libraries for Java, Python, and JavaScript, which are built directly from source code in a hardened, SLSA Level 2 compliant build environment. This process is designed to mitigate the risks associated with public package registries, such as malware injection and compromised build processes. By providing a standardized, secure endpoint for developers to consume dependencies, Chainguard Libraries helps organizations secure every layer of the software development lifecycle, from the operating system and runtime to the application code. The service aims to enhance developer productivity by removing the friction of manual package curation and security vetting, allowing teams to build software faster without compromising on security.

Chainguard Images

Chainguard

Chainguard Images provides a catalog of minimal, hardened, and secure container base images designed to significantly reduce the attack surface of cloud-native applications. These images are built from source, stripped of unnecessary components like shells and package managers, which results in an average 97.6% reduction in common vulnerabilities and exposures (CVEs). Each image is rebuilt and patched daily to incorporate the latest security fixes, aiming for a zero-known-vulnerability state. Chainguard Images are targeted at developers, DevOps, and security teams looking to enhance their software supply chain security by default. The service provides comprehensive provenance through Software Bill of Materials (SBOMs), cryptographic signatures using Sigstore, and compliance with standards like SLSA Level 2, ensuring transparency and trust in the software being deployed.