Chainguard Academy
Product Docs
Containers
Overview
Network Requirements
About
Build Criteria
Shared Responsibility Model
Going Distroless
How We Test
Container Variants
Product Release Lifecycle
Container Categories
Compiled Programs
Selecting a Container
glibc vs. musl
Video: Low-to-No CVEs
Video: Beyond Zero
Features
Custom Assembly
Overview
Manage with chainctl
Manage with Chainguard's API
EOL Grace Period
STIGs
Unique Tags
Tag History API
FIPS
FIPS FAQs
FIPS Containers
CVE Visualizations
Custom Certificates
Private APK Repositories
How to Use
Using Chainguard Containers
Retrieve SBOM
Verifying Containers
Containers Directory
Dev Containers
Using the Static Base Container
Digests
Reproducible Dockerfiles
Software Versions
Minimal Runtime Containers
Getting Started Guides
C/C++
Cilium
Go
Istio
Laravel
MariaDB
NeMo
nginx
Node
PHP
PostgreSQL
Python
PyTorch
Ruby
WordPress
JRE + Minecraft
Staying Secure
Minimize CVE Risk
FedRAMP Considerations
Video: Reproducibility
Updating Containers
Container Update Considerations
EOL Vulnerabilities
Update Strategies and Tools
Using Renovate
Up-to-date Containers with Digestabot
Security Advisories
Using Advisories
Advisory Life Cycle
Managing Advisories
Working with Scanners
False Positives and Negatives
Grype
Trivy
Troubleshooting
Debugging
Video: Debugging Distroless Containers
Video: Debugging with Kubectl and CDebug
Vulnerability Comparisons
bash
busybox
curl
deno
dex
dotnet-runtime
dotnet-sdk
etcd
git
go
gradle
haproxy
jenkins
kube-state-metrics
mariadb
maven
memcached
minio
minio-client
nats
nginx
node
opensearch
php
postgres
python
r-base
rabbitmq
redis
ruby
rust
telegraf
traefik
wait-for-it
wolfi-base
zookeeper
FAQs
Libraries
Libraries Overview
Access
Network Requirements
FAQ
Java
Java Overview
Global Configuration
Build Configuration
Management
Python
Python Overview
Global Configuration
Build Configuration
Management
Registry
Registry Overview
Authenticate
Pull Through Guides
Google Artifact Registry
Artifactory
Registry Pull-Through
Mirroring Packages
Nexus
Cloudsmith
Migration
Migration Overview
Migration Tips
Porting a Sample Application
Migrating Dockerfiles
Migration Checklist
Dockerfile Converter
Compatibility
Alpine
Debian
Ubuntu
Red Hat
Migration Guides
PHP
Node
Video: Node.js
Python
Video: Go
Video: Java
Administration
Terraform Provider
IAM & Organizations
IAM Overview
Manage IAM Organizations
Verified Organizations
Roles and Role-bindings
Roles and Role-bindings Overview
GitHub Team Role-binding
Events
Chainguard Events
Subscribe to Events
Mirror Containers to Artifact Registry
Assumable Identities
Assumable IDs Overview
Identity Examples
GitHub Actions
GitLab CI/CD
AWS Lambda
AWS EC2
Buildkite
Bitbucket
Jenkins
Keycloak
Custom Identity Providers
Authenticate with Custom IDPs
Identity Provider Examples
Okta
Ping Identity
Keycloak
Microsoft Entra ID
SDK Authentication
OpenAPI Specification
chainctl Usage
Install chainctl
Get Started with chainctl
chainctl vs Console
Manage Your chainctl Configuration
Find and Update Your chainctl Release Version
Compare Images with chainctl
Create, View, and Delete chainctl Events
Manage Identity and Access with chainctl
Manage Chainguard Container Images with chainctl
chainctl Reference
chainctl
chainctl auth
chainctl auth configure-docker
chainctl auth login
chainctl auth logout
chainctl auth pull-token
chainctl auth status
chainctl auth token
chainctl config
chainctl config edit
chainctl config reset
chainctl config save
chainctl config set
chainctl config unset
chainctl config validate
chainctl config view
chainctl events
chainctl events subscriptions
chainctl events subscriptions create
chainctl events subscriptions delete
chainctl events subscriptions list
chainctl iam
chainctl iam account-associations
chainctl iam account-associations check
chainctl iam account-associations check aws
chainctl iam account-associations check gcp
chainctl iam account-associations describe
chainctl iam account-associations set
chainctl iam account-associations set aws
chainctl iam account-associations set gcp
chainctl iam account-associations unset
chainctl iam account-associations unset aws
chainctl iam account-associations unset gcp
chainctl iam folders
chainctl iam folders delete
chainctl iam folders describe
chainctl iam folders list
chainctl iam folders update
chainctl iam identities
chainctl iam identities create
chainctl iam identities create github
chainctl iam identities create gitlab
chainctl iam identities delete
chainctl iam identities describe
chainctl iam identities list
chainctl iam identities update
chainctl iam identity-providers
chainctl iam identity-providers create
chainctl iam identity-providers delete
chainctl iam identity-providers list
chainctl iam identity-providers update
chainctl iam invites
chainctl iam invites create
chainctl iam invites delete
chainctl iam invites list
chainctl iam organizations
chainctl iam organizations delete
chainctl iam organizations describe
chainctl iam organizations list
chainctl iam role-bindings
chainctl iam role-bindings create
chainctl iam role-bindings delete
chainctl iam role-bindings list
chainctl iam role-bindings update
chainctl iam roles
chainctl iam roles capabilities
chainctl iam roles capabilities list
chainctl iam roles create
chainctl iam roles delete
chainctl iam roles list
chainctl iam roles update
chainctl images
chainctl images diff
chainctl images history
chainctl images list
chainctl images repos
chainctl images repos build
chainctl images repos build apply
chainctl images repos build edit
chainctl images repos build list
chainctl images repos build logs
chainctl images repos list
chainctl packages
chainctl packages versions
chainctl packages versions list
chainctl update
chainctl version
Open Source
Build Tools
apko
apko Overview
apko FAQs
Getting Started with apko
Troubleshooting apko Builds
Bazel Rules
melange
melange Overview
Getting Started with melange
Troubleshooting Builds
melange FAQs
SLSA
What is SLSA?
SBOMs
What is an SBOM?
OpenVEX and vexctl
What Makes a Good SBOM?
What is OpenVex?
SBOMs and Attestations
Wolfi
Wolfi Overview
Building a Wolfi Package
Wolfi FAQs
Why apk
Hello Wolfi Workshop
Wolfi Images with Dockerfiles
Package Version Selection
Open Container Initiative
What is the OCI?
What are OCI Artifacts?
Sigstore
Keyless Signing
Cosign
Introduction
Install
Sign a Container
Sign Blobs and Files
Sign an SBOM
Verify File Signatures
Cosign: The Manual Way
Policy Controller
Install
Policies
Enforce SBOM attestation with Policy Controller
Disallowing Non-Default Capabilities
Disallowing Privileged Pods
Disallowing Run as Root User
Maximum Container Image Age
Disallowing Unsafe sysctls
Verify Signed Chainguard Containers
Critical CVEs
Rego Policies
Example Policies
Fulcio
Introduction
Generate Fulcio Certificate
Inspect and Verify Certificates
Rekor
Introduction
Install
Query Rekor
Sign and Upload Metadata
Set Up Local Instance
Education
Containers
Selecting a Base Image
Software Supply Chain Security
Chainguard Glossary
Trademark Use Policy
Compliance
PCI DSS 4.0
Introduction to the PCI Data Security Standard (DSS) 4.0
Overview of PCI DSS 4.0 Practices/Requirements
Simplify Your Path to PCI DSS 4.0 Compliance with Chainguard
CMMC 2.0
Introduction to the Cybersecurity Maturity Model Certification (CMMC) 2.0
CMMC 2.0 Maturity Levels
Overview of CMMC 2.0 Practices/Control Groups
Simplify Your Path to CMMC 2.0 Compliance with Chainguard
CIS Benchmarks
Comics
#1 - Fighting Vulnerabilities
CVEs
What Are Software Vulnerabilities and CVEs?
Why Care About Software Vulnerabilities?
Infamous Software Vulnerabilities
Software Vulnerability Remediation
Secure Software Recommendations
Self-Attestation Form
Table of NIST SSDF
Minimum Attestation References
Go to Chainguard.dev
Send feedback
Contact
Chainguard Academy
Product Docs
Containers
Overview
Network Requirements
About
Build Criteria
Shared Responsibility Model
Going Distroless
How We Test
Container Variants
Product Release Lifecycle
Container Categories
Compiled Programs
Selecting a Container
glibc vs. musl
Video: Low-to-No CVEs
Video: Beyond Zero
Features
Custom Assembly
Overview
Manage with chainctl
Manage with Chainguard's API
EOL Grace Period
STIGs
Unique Tags
Tag History API
FIPS
FIPS FAQs
FIPS Containers
CVE Visualizations
Custom Certificates
Private APK Repositories
How to Use
Using Chainguard Containers
Retrieve SBOM
Verifying Containers
Containers Directory
Dev Containers
Using the Static Base Container
Digests
Reproducible Dockerfiles
Software Versions
Minimal Runtime Containers
Getting Started Guides
C/C++
Cilium
Go
Istio
Laravel
MariaDB
NeMo
nginx
Node
PHP
PostgreSQL
Python
PyTorch
Ruby
WordPress
JRE + Minecraft
Staying Secure
Minimize CVE Risk
FedRAMP Considerations
Video: Reproducibility
Updating Containers
Container Update Considerations
EOL Vulnerabilities
Update Strategies and Tools
Using Renovate
Up-to-date Containers with Digestabot
Security Advisories
Using Advisories
Advisory Life Cycle
Managing Advisories
Working with Scanners
False Positives and Negatives
Grype
Trivy
Troubleshooting
Debugging
Video: Debugging Distroless Containers
Video: Debugging with Kubectl and CDebug
Vulnerability Comparisons
bash
busybox
curl
deno
dex
dotnet-runtime
dotnet-sdk
etcd
git
go
gradle
haproxy
jenkins
kube-state-metrics
mariadb
maven
memcached
minio
minio-client
nats
nginx
node
opensearch
php
postgres
python
r-base
rabbitmq
redis
ruby
rust
telegraf
traefik
wait-for-it
wolfi-base
zookeeper
FAQs
Libraries
Libraries Overview
Access
Network Requirements
FAQ
Java
Java Overview
Global Configuration
Build Configuration
Management
Python
Python Overview
Global Configuration
Build Configuration
Management
Registry
Registry Overview
Authenticate
Pull Through Guides
Google Artifact Registry
Artifactory
Registry Pull-Through
Mirroring Packages
Nexus
Cloudsmith
Migration
Migration Overview
Migration Tips
Porting a Sample Application
Migrating Dockerfiles
Migration Checklist
Dockerfile Converter
Compatibility
Alpine
Debian
Ubuntu
Red Hat
Migration Guides
PHP
Node
Video: Node.js
Python
Video: Go
Video: Java
Administration
Terraform Provider
IAM & Organizations
IAM Overview
Manage IAM Organizations
Verified Organizations
Roles and Role-bindings
Roles and Role-bindings Overview
GitHub Team Role-binding
Events
Chainguard Events
Subscribe to Events
Mirror Containers to Artifact Registry
Assumable Identities
Assumable IDs Overview
Identity Examples
GitHub Actions
GitLab CI/CD
AWS Lambda
AWS EC2
Buildkite
Bitbucket
Jenkins
Keycloak
Custom Identity Providers
Authenticate with Custom IDPs
Identity Provider Examples
Okta
Ping Identity
Keycloak
Microsoft Entra ID
SDK Authentication
OpenAPI Specification
chainctl Usage
Install chainctl
Get Started with chainctl
chainctl vs Console
Manage Your chainctl Configuration
Find and Update Your chainctl Release Version
Compare Images with chainctl
Create, View, and Delete chainctl Events
Manage Identity and Access with chainctl
Manage Chainguard Container Images with chainctl
chainctl Reference
chainctl
chainctl auth
chainctl auth configure-docker
chainctl auth login
chainctl auth logout
chainctl auth pull-token
chainctl auth status
chainctl auth token
chainctl config
chainctl config edit
chainctl config reset
chainctl config save
chainctl config set
chainctl config unset
chainctl config validate
chainctl config view
chainctl events
chainctl events subscriptions
chainctl events subscriptions create
chainctl events subscriptions delete
chainctl events subscriptions list
chainctl iam
chainctl iam account-associations
chainctl iam account-associations check
chainctl iam account-associations check aws
chainctl iam account-associations check gcp
chainctl iam account-associations describe
chainctl iam account-associations set
chainctl iam account-associations set aws
chainctl iam account-associations set gcp
chainctl iam account-associations unset
chainctl iam account-associations unset aws
chainctl iam account-associations unset gcp
chainctl iam folders
chainctl iam folders delete
chainctl iam folders describe
chainctl iam folders list
chainctl iam folders update
chainctl iam identities
chainctl iam identities create
chainctl iam identities create github
chainctl iam identities create gitlab
chainctl iam identities delete
chainctl iam identities describe
chainctl iam identities list
chainctl iam identities update
chainctl iam identity-providers
chainctl iam identity-providers create
chainctl iam identity-providers delete
chainctl iam identity-providers list
chainctl iam identity-providers update
chainctl iam invites
chainctl iam invites create
chainctl iam invites delete
chainctl iam invites list
chainctl iam organizations
chainctl iam organizations delete
chainctl iam organizations describe
chainctl iam organizations list
chainctl iam role-bindings
chainctl iam role-bindings create
chainctl iam role-bindings delete
chainctl iam role-bindings list
chainctl iam role-bindings update
chainctl iam roles
chainctl iam roles capabilities
chainctl iam roles capabilities list
chainctl iam roles create
chainctl iam roles delete
chainctl iam roles list
chainctl iam roles update
chainctl images
chainctl images diff
chainctl images history
chainctl images list
chainctl images repos
chainctl images repos build
chainctl images repos build apply
chainctl images repos build edit
chainctl images repos build list
chainctl images repos build logs
chainctl images repos list
chainctl packages
chainctl packages versions
chainctl packages versions list
chainctl update
chainctl version
Open Source
Build Tools
apko
apko Overview
apko FAQs
Getting Started with apko
Troubleshooting apko Builds
Bazel Rules
melange
melange Overview
Getting Started with melange
Troubleshooting Builds
melange FAQs
SLSA
What is SLSA?
SBOMs
What is an SBOM?
OpenVEX and vexctl
What Makes a Good SBOM?
What is OpenVex?
SBOMs and Attestations
Wolfi
Wolfi Overview
Building a Wolfi Package
Wolfi FAQs
Why apk
Hello Wolfi Workshop
Wolfi Images with Dockerfiles
Package Version Selection
Open Container Initiative
What is the OCI?
What are OCI Artifacts?
Sigstore
Keyless Signing
Cosign
Introduction
Install
Sign a Container
Sign Blobs and Files
Sign an SBOM
Verify File Signatures
Cosign: The Manual Way
Policy Controller
Install
Policies
Enforce SBOM attestation with Policy Controller
Disallowing Non-Default Capabilities
Disallowing Privileged Pods
Disallowing Run as Root User
Maximum Container Image Age
Disallowing Unsafe sysctls
Verify Signed Chainguard Containers
Critical CVEs
Rego Policies
Example Policies
Fulcio
Introduction
Generate Fulcio Certificate
Inspect and Verify Certificates
Rekor
Introduction
Install
Query Rekor
Sign and Upload Metadata
Set Up Local Instance
Education
Containers
Selecting a Base Image
Software Supply Chain Security
Chainguard Glossary
Trademark Use Policy
Compliance
PCI DSS 4.0
Introduction to the PCI Data Security Standard (DSS) 4.0
Overview of PCI DSS 4.0 Practices/Requirements
Simplify Your Path to PCI DSS 4.0 Compliance with Chainguard
CMMC 2.0
Introduction to the Cybersecurity Maturity Model Certification (CMMC) 2.0
CMMC 2.0 Maturity Levels
Overview of CMMC 2.0 Practices/Control Groups
Simplify Your Path to CMMC 2.0 Compliance with Chainguard
CIS Benchmarks
Comics
#1 - Fighting Vulnerabilities
CVEs
What Are Software Vulnerabilities and CVEs?
Why Care About Software Vulnerabilities?
Infamous Software Vulnerabilities
Software Vulnerability Remediation
Secure Software Recommendations
Self-Attestation Form
Table of NIST SSDF
Minimum Attestation References
Go to Chainguard.dev
Send feedback
Contact
Chainguard's Registry
Registry Overview
Authenticate to Chainguard's Registry
Pull Through Guides
