Chainguard

Chainguard, founded in 2021, builds secure-by-default open source container images, libraries and virtual machine images, positioning itself as "the safe source for open source." The company's premise is that engineering teams should not have to trade speed, security or scalability against one another; its products are designed to remove that trade-off from the software supply chain. Its founders built foundational open source projects, including Kubernetes, Sigstore and Distroless, at Google.

Its flagship product is a catalog of minimal, zero-CVE container images, which the company claims is the largest of its kind. Two further lines extend the approach: Chainguard Libraries, secure open source libraries, and Chainguard VMs, secure-by-default virtual machine images. Underpinning them is Chainguard Factory, a platform that continuously builds and updates thousands of artifacts.

Technical domains covered include software supply chain security, container security, open source security, DevSecOps, secure software builds and vulnerability management. The company cites a reduction of 1,000 hours of engineering toil per year for customers and a role in helping them achieve FedRAMP High authorization. Sectors served include software development, open source, cloud-native and Kubernetes environments, and government and public sector work.

Chainguard describes itself as serious about its mission and "playful about everything else." The stated mission is to guard open source software so that customers can build what matters, with an emphasis on verifiably secure code.