Chainguard Workspaces on

Chainguard Workspaces overview

Thu, 08 Oct 2026 00:00:00 +0000

Chainguard Workspaces moves development, and the coding agents that do it, off your laptop. The chainctl develop command opens a session: a Linux microVM in Chainguard’s cloud with your repository checked out, the tools your repository needs, and, by default, Claude Code. You work in it from your own terminal.

A coding agent that runs on your laptop can read your SSH keys, cloud credentials, and browser sessions, and every package it installs runs with the same access. In a session, the agent works in a separate VM that holds no long-lived credentials. When the agent pushes to GitHub or calls Claude, the request leaves the VM without a credential, and your laptop or Chainguard adds one on the way out.

Get started with Chainguard Workspaces

Thu, 08 Oct 2026 00:00:00 +0000

This guide walks you through signing up for Chainguard Workspaces, opening a session on one of your repositories, detaching from the session, and returning to it. It takes about 15 minutes.

Note: Chainguard Workspaces is in beta. Available to organizations that turn it on with chainctl develop init, which comes with a free monthly allowance, or that arrange access with their Chainguard account team.

Manage Chainguard Workspaces sessions

Thu, 08 Oct 2026 00:00:00 +0000

A Chainguard Workspaces session lasts beyond a single terminal. You can detach from it and return later, keep it running while an agent works, run more than one terminal in it, or open several sessions on the same repository. This page explains how to do each of these with chainctl develop.

The examples on this page use $ORGANIZATION for the name of your Chainguard organization. If you belong to only one organization, you can omit --parent.

Configure a Chainguard Workspaces session's environment

Thu, 08 Oct 2026 00:00:00 +0000

A Chainguard Workspaces session’s environment is the set of packages installed in its VM and the network access it has. Packages come from Chainguard OS, the same packages behind Chainguard Containers. This page explains where a session’s environment comes from and how to change it.

A session’s environment is fixed when the session is created. If your repository’s .chainguard/develop.yaml or .chainguard/ci.yaml file changes afterward, existing sessions keep the environment they started with, and chainctl reminds you when you return to them. To use the new environment, open a new session with chainctl develop --new.

Manage Chainguard Workspaces session credentials

Thu, 08 Oct 2026 00:00:00 +0000

A Chainguard Workspaces session holds no long-lived credentials: its VM stores no API keys, tokens, or registry logins. Instead, the session reaches each service through a local hostname, and the credential is added to the request outside the VM. This page explains what a session can reach by default, how to change it, and which credentials a session can’t supply.

A check in Chainguard Checks can get short-lived credentials through a workload identity, which a session can’t use. Refer to Workload identities and trust.

Let Chainguard Workspaces sessions act on GitHub as you

Mon, 12 Oct 2026 00:00:00 +0000

By default, a Chainguard Workspaces session reaches GitHub through the Chainguard App with access to specific repositories, as described in Manage session credentials. If you connect your GitHub account, the sessions you create afterward act on GitHub as you instead, unless your organization’s user_github policy bans it. They act through the Chainguard Develop GitHub App (chainguard-develop), which is separate from the Chainguard App that runs Chainguard Checks. A session that acts as you can do the following:

Use Claude Code in a Chainguard Workspaces session

Thu, 08 Oct 2026 00:00:00 +0000

A Chainguard Workspaces session is a place for a coding agent to work with less risk to your laptop. The agent runs in the session’s VM, which holds no long-lived credentials, and it reaches Claude with your own Claude credential, which stays outside the VM. This page explains how to run Claude Code in a session.

Claude Code is the only coding agent that sessions supply a model credential for. You can install other coding agents in a session, but sessions don’t send them a credential.

chainctl develop command reference

Mon, 12 Oct 2026 00:00:00 +0000

The chainctl develop command opens and manages Chainguard Workspaces sessions. This page lists each chainctl develop command, with its flags, output formats, exit codes, and the roles it needs. For how the commands fit together, refer to Manage sessions.

During the beta, the chainctl checks and chainctl develop commands don’t appear in chainctl --help or in the chainctl reference. You can still run them, and --help on either one shows its full help.

Troubleshoot Chainguard Workspaces

Thu, 08 Oct 2026 00:00:00 +0000

This page describes common problems with Chainguard Workspaces sessions and how to fix them. If your problem isn’t listed here, ask in the #workspaces-questions channel in the Chainguard community Slack.

Chainguard Workspaces on

Chainguard Workspaces overview

Get started with Chainguard Workspaces

Step 1: Sign up

Manage Chainguard Workspaces sessions

Configure a Chainguard Workspaces session's environment

Manage Chainguard Workspaces session credentials

Let Chainguard Workspaces sessions act on GitHub as you

Use Claude Code in a Chainguard Workspaces session

chainctl develop command reference

Troubleshoot Chainguard Workspaces

chainctl doesn’t list the develop command