Chainguard Registry
Chainguard Registry provides container images built from source each day, with a focus on minimal images and hardening.
What Chainguard Registry is
Chainguard Registry provides container images built from source each day, with a focus on minimal images and hardening. Its directory lists 3,115 projects and 735,898 images. The free image offer allows up to five images per organization; the FAQ describes a free set of about 50 images, limited to :latest tags and without a CVE remediation SLA. Paid catalog access lists upstream-supported major and minor versions, and a contractual remediation SLA of seven days for critical vulnerabilities and 14 days for high, medium, and low vulnerabilities. Chainguard says its images are continuously built in SLSA L3 hardened infrastructure with CVE patching. Listed artifact features include Sigstore signatures, build-time SBOMs, and digital attestations. Catalog plans also include automated Custom Assembly tooling and a private APK repository with more than 10,000 packages for image customization. Images can be pulled from Chainguard or mirrored to listed artifact managers. The service is available on Linux, self-hosted, and web, and offers both free and enterprise-quote plans.
Good
- Free offer allows up to five images per organization
- Catalog lists more than 3,000 images
- Contractual CVE remediation timelines are specified
- Lists scanner compatibility and artifact manager options
- Catalog includes customization tooling and a private APK repository
Watch out
- Free image set is limited to :latest tags
- Free image set has no CVE remediation SLA
- Immutable tags are not supported
Who it suits
Chainguard describes its container catalog as a foundation for engineers. Its catalog licensing model is aimed at organizations that rely heavily on Chainguard Containers.
Verdict
Chainguard Registry offers free access for a small image selection and broader catalog plans for organizations needing supported versions, customization, and contractual remediation terms. The free image restrictions and enterprise-quote pricing are important distinctions when choosing a plan.
Plans and prices
From Chainguard Registry's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free Images | Free | Up to five images per organization · Base, Application, and AI/ML images · no CVE remediation SLA stated for the free image set |
| Catalog | Priced on request | Licensed by engineering organization size · full catalog access to 3,000+ images · contractual CVE SLA · net new image requests · Request Enterprise pricing |
| Per Image | Priced on request | Licensed by number and type of images · contractual CVE SLA · all upstream supported tags · Request Enterprise pricing |
The facts
Each one read from Chainguard Registry's own pages, with the date it was checked.
What it does
- Artifact evidence
- The pricing page lists Sigstore-signed artifacts with build-time SBOMs and digital attestations.checked 3 Oct 2026
- Artifact managers
- The pricing FAQ says customers can pull from Chainguard's registry or mirror images to JFrog Artifactory, Cloudsmith, Harbor, Nexus, Google Artifact Registry, Docker Hub, Amazon ECR, and Microsoft ACR.checked 3 Oct 2026
- Build security
- The pricing page says container images are continuously built from source in SLSA L3 hardened infrastructure with CVE patching.checked 3 Oct 2026
- Catalog size
- The image directory lists 3,115 projects and 735,898 images.checked 3 Oct 2026
- Compliance images
- The pricing page lists access to STIG-hardened and FIPS-validated images as a feature.checked 3 Oct 2026
- Customization
- Catalog plans include automated Custom Assembly tooling and access to a private APK repository with more than 10,000 packages for image customization.checked 3 Oct 2026
- Intended users
- Chainguard describes the product as a foundation for engineers and says the catalog licensing model is suited to organizations relying heavily on Chainguard Containers.checked 3 Oct 2026
- Product
- Chainguard Containers provides minimal, hardened container images rebuilt from source daily.checked 3 Oct 2026
- Remediation SLA
- The listed contractual CVE SLA is seven days for critical vulnerabilities and 14 days for high, medium, and low vulnerabilities.checked 3 Oct 2026
- Scanner integrations
- Chainguard lists compatibility with scanners including Anchore, Aqua Trivy, AWS, CrowdStrike, GitLab, Grype, Qualys, Snyk, and Wiz.checked 3 Oct 2026
- Support
- The site directs prospective customers to contact Chainguard for an enterprise quote and links to a support portal.checked 3 Oct 2026
- Supported versions
- The pricing page lists upstream supported versions, including major and minor tags, and says EOL versions and EmeritOSS images are excluded.checked 3 Oct 2026
The company
- Founded
- 2021checked 28 Sep 2026
- Headquarters
- Seattle, Washington, United Stateschecked 28 Sep 2026
- Maker
- The maker identifies itself as Chainguard, Inc.checked 3 Oct 2026
Money
- Free access
- The pricing page offers five images to test and deploy in production for free, with up to five images per organization.checked 3 Oct 2026
- Free image limit
- The FAQ says the freely available image set has about 50 images, includes only :latest tags, and is not covered by the CVE remediation SLA.checked 3 Oct 2026
Alternatives to Chainguard Registry
- 1
JFrog Container Registry
Free planWebAPILinuxSelf-hosted7.6Free plan - 2
Inedo ProGet
Free planWebAPILinuxSelf-hosted7.4From $2,395 a year - 3
Alibaba Cloud Container Registry
Free planWebAPILinuxWindows7.1Free plan - 4
Oracle Cloud Infrastructure Container Registry
Free planWebAPILinux7.0Free plan - 5
Samsung Cloud Platform Container Registry
AndroidiOSWebAPI7.0 - 6
lazer.sh
Free planWebAPILinux6.8From $4.99 a month