Chainguard Images

This repository holds the public build configuration for available Chainguard Images — minimal, hardened OCI images published to cgr.dev/chainguard/<image>.

Using an image

Images are published at cgr.dev/chainguard/<name>. For example:

docker pull cgr.dev/chainguard/static:latest
docker pull cgr.dev/chainguard/nginx:latest

Browse the full catalog at images.chainguard.dev. Each image’s usage notes live in its own README under images/<name>/README.md.

How images are built

Every image is produced with apko from a pinned, reproducible configuration stored alongside the image:

images/<name>/
├── locked_config.json   # Pinned apko config per architecture (+ tags, repo)
├── README.md            # User-facing documentation for the image
├── tests/               # End-to-end tests
└── metadata.yaml        # Image metadata

locked_config.json is the source of truth for what goes into the published image. It contains a fully resolved apko configuration — exact package versions, accounts, entrypoint, environment, and annotations — for each supported architecture. Because the package versions are pinned, builds are reproducible: the same locked_config.json produces the same image content.

Publication is driven by the release.yaml workflow. When a locked_config.json changes on main (or on the daily schedule), the workflow shards the affected images and invokes the Terraform module at main.tf, which:

1. Reads images/<name>/locked_config.json.
2. Builds each variant with the apko Terraform provider.
3. Publishes the resulting OCI images to cgr.dev/chainguard/<name> along with SBOMs and cosign attestations.
4. Applies the tags declared in the lock file.

Building an image locally

You can reproduce a build on your own machine using apko and the locked_config.json checked into this repo. See BUILDING.md for a step-by-step example.

Repository layout

More

• Image guidelines — the design standards every image follows.
• Withdrawing images — how tags and repos are retired.
• Security policy — reporting vulnerabilities.
• Chainguard Images docs — background and concepts.
• Chainguard Console — log in to view the full commercial catalog.