Chainguard

Chainguard supplies hardened open source software for engineering teams and AI systems, including container images, language libraries, virtual machines, and operating-system packages. Chainguard Containers offers more than 3,000 images, rebuilt from source as upstream software changes. Chainguard Libraries replaces public package-registry endpoints with dependencies rebuilt from verified source code rather than downloaded as precompiled artifacts. Both products combine maintained software with records of its contents and build history, helping teams address vulnerabilities and verify what enters their software supply chains.

Chainguard launched in October 2021 with five co-founders, including Dan Lorenc, Matt Moore, and Ville Aikas. Lorenc serves as CEO and Moore as CTO on the company’s leadership team. Its founding position was that build systems are production systems and should be secured accordingly, with open source tools and standards making secure development easier to adopt.

Two of Chainguard’s open source projects put that approach into practice. Wolfi is a Linux distribution designed for containers: granular, independent packages let developers assemble minimal images, while the host environment supplies the kernel. apko assembles container images declaratively from APK packages. Unlike a Dockerfile, an apko configuration cannot run arbitrary build commands; custom applications must first be packaged as APKs. That restriction lets apko produce bitwise-reproducible images and generate software bills of materials, or SBOMs, covering their complete contents.

For production teams, Chainguard combines those maintained artifacts with vulnerability-remediation service commitments. Its Custom Assembly capability lets customers add packages, certificates, and environment variables to container images under its CVE-remediation SLA. Images carry cryptographic signatures, signed component inventories, and build provenance so teams can check their authenticity, contents, and origin. Libraries integrates with existing artifact managers, including JFrog Artifactory and Sonatype Nexus Repository, as an upstream dependency source. Developers can therefore consume Chainguard-built dependencies through familiar tools without adopting a separate build workflow.