Chainguard

Chainguard, founded in 2021, builds secure-by-default open source software artifacts: container images, libraries, and virtual machines designed to secure the software supply chain for engineering teams. The company maintains what it describes as the largest catalog of minimal, zero-CVE container images - dependencies stripped to their essentials and kept free of known vulnerabilities so that engineering teams can rely on them without extensive remediation work.

Underpinning the catalogue is Chainguard Factory, a continuous build and update system that constructs and refreshes thousands of artifacts. The stated aim is to make verifiably secure code the default rather than an afterthought, so that teams need not trade speed against security or scale. Customers are said to eliminate around 1,000 hours of engineering toil a year as a result, and the company reports that its artifacts help customers reach FedRAMP High authorisation.

The work spans software supply chain security, open source security, build automation, and software artifact integrity, with applications across developer tooling, cloud native and Kubernetes environments, and the public sector. Chainguard describes itself as "the safe source for open source"; its founders bring open source credentials from projects including Kubernetes, Sigstore, and Distroless at Google. The company characterises its culture as serious about its mission and playful about everything else.