Chainguard Registry

Chainguard Registry is a catalog of minimal container images rebuilt from source daily, with security evidence aimed at production engineering teams. It fits organizations that depend on Chainguard Containers and need defined vulnerability-remediation commitments more than a large free allowance. The free tier is useful for a limited evaluation, while serious catalog use belongs in a paid plan.

Overview

Chainguard’s directory spans 3,115 projects and 735,898 images, but the headline catalog size should not be confused with free coverage. Free access permits up to five images per organization for testing and production deployment. The freely available set is about 50 images, limited to :latest tags, and carries no CVE remediation SLA. That makes the free offer a practical way to validate selected images, not a broad foundation for a sizeable estate.

The images are rebuilt from source every day, and Chainguard describes continuous builds in SLSA L3 hardened infrastructure with CVE patching. This combination is most relevant to teams that must show how artifacts were built and maintained, rather than simply pull a conventional base image.

Key features

Sigstore-signed artifacts, build-time SBOMs and digital attestations provide provenance and component evidence for security review. Chainguard lists integrations with Anchore, Aqua Trivy, AWS, CrowdStrike, GitLab, Grype, Qualys, Snyk and Wiz, so teams can retain an established scanning workflow instead of adopting a dedicated scanner.

Paid catalog terms include a contractual CVE SLA of seven days for critical vulnerabilities and 14 days for high, medium and low vulnerabilities. That is a concrete operational commitment, and a significant reason to move beyond free images. Catalog plans include upstream-supported major and minor tags; end-of-life versions and EmeritOSS images are excluded, so workloads pinned to those releases need another source.

Customers can pull directly from Chainguard’s registry or mirror images to JFrog Artifactory, Cloudsmith, Harbor, Nexus, Google Artifact Registry, Docker Hub, Amazon ECR and Microsoft ACR. Catalog plans also add automated Custom Assembly tooling and a private APK repository with more than 10,000 packages, supporting image customization without giving up the catalog’s security model. STIG-hardened and FIPS-validated images are listed for compliance-driven deployments.

Pricing

Free Images — free. Each organization can use up to five images, including Base, Application and AI/ML images. The broader free image set is about 50 images and exposes only :latest tags; it has no CVE remediation SLA. This is appropriate for a pilot or a small number of production images, but restrictive for teams needing version coverage or a larger image portfolio.

Catalog — price on request. Chainguard bills this as a request for enterprise pricing and licenses it by engineering-organization size. It provides the full catalog of more than 3,000 images, a contractual CVE SLA and net-new image requests. This is the logical fit for organizations relying heavily on Chainguard Containers and willing to negotiate on organizational scale, rather than buyers seeking a transparent self-serve price.

Per Image — custom pricing. This plan is licensed by the number and type of images and includes a contractual CVE SLA plus all upstream-supported tags. It can suit a focused deployment that does not need the full catalog, but the price is not published, so budgeting requires an enterprise conversation. Chainguard offers a free trial, while enterprise support and quotes are handled through its support portal and sales contact.

Platforms

Chainguard Registry supports Linux, self-hosted deployments and the web. It also supports image mirroring to several third-party artifact managers, which helps organizations keep registry placement aligned with existing infrastructure.

Who it's for

This is a strong choice for engineering organizations that prioritize minimal images, supply-chain evidence, scanner interoperability and contractual remediation targets. Compliance teams may value the STIG-hardened and FIPS-validated image options, while platform teams can use Custom Assembly and the private APK repository for tailored builds.

It is less suitable for a small team needing many free images, historical tags or a simple published subscription. The free allowance is deliberately narrow, and paid pricing depends on enterprise terms.

Pros and cons

• Pro: Daily source rebuilds, SLSA L3 infrastructure, signed artifacts, SBOMs and attestations provide unusually strong build evidence.
• Pro: Paid plans put seven-day critical and 14-day other-severity CVE targets into a contract.
• Pro: Broad scanner and artifact-manager compatibility supports existing security and distribution workflows.
• Con: Free access is limited to five images per organization, with about 50 available images and only :latest tags.
• Con: The free image set has no CVE remediation SLA, and paid pricing is oriented around enterprise quotes.
• Con: EOL and EmeritOSS images are excluded from supported catalog versions.

Alternatives

For a general-purpose desktop container workflow, choose Docker Desktop instead; its free Personal plan includes Docker Desktop, Docker Engine, Kubernetes, Docker Hub, Docker Scout and Docker Debug across Linux, macOS and Windows. Teams wanting a self-hosted package and Docker registry with a free edition should consider Inedo ProGet, whose free plan offers unlimited feeds but limited security and compliance features. JFrog Container Registry is a free self-managed option for Docker, OCI, Helm and generic artifacts, though its free edition has no Xray. For an Apache 2.0 open-source registry with full or minimal builds, pick Zot Registry. 8gears Container Registry suits individuals wanting 1 GB storage, unlimited private repositories and community support at no cost. Cosmoner Container Registry charges for egress after its included allowance while image uploads are free. KakaoCloud Container Registry offers 30 GiB of free outbound traffic before usage charges. For a hosted registry with explicit hobby limits, lazer.sh starts at $4.99 per month with 100 GB storage and unlimited pulls.

Browse more options in Container Registries.

Verdict

Choose Chainguard Registry when your organization needs hardened, minimal images backed by provenance evidence and a contractual CVE-remediation timetable. Its principal advantage is the combination of secure rebuild practices, supported integrations and enterprise commitments. Look elsewhere if five free images, :latest-only access or custom enterprise pricing cannot meet your deployment and budget requirements.