The AI-powered factory rebuilding open source

Reconciler bots and AI agents run continuously across our entire catalog — so every artifact you get from Chainguard meets the same security standard.

Chainguard Factory

Monitoring

• Latency: 26ms
• Command: $chainguardfactory --watch
• Monitoring: 2,847 upstream sources (registries · repos · CVE feeds · distro trackers)

Events

• Drift detected: nginx@1.27.4 → 1.27.5

• Reconciler: started · diffing desired vs. actual · applying patch · queuing rebuild

• Reconciler stuck: patch conflict at NGINX/conf.d:42

  • Dispatching agent: fix-patch
  • Resolved in 4.2s: retrying build

• Build Status: passed · tests passed · SLSA L3 attested

• Artifact: signed:sha256:9c8a3f…d4 → delivered:cgr.dev/chainguard/nginx:1.27.5

• Artifacts shipped today: 12,447

• Uptime: 99.99%

Why we built it

A factory built for what's coming.

Modern security demands artifacts that are always up to date, and the only way to deliver that at scale is to rebuild them, automatically, around the clock. So we built a factory that does exactly that. Thousands of artifacts, every shape your team needs, all kept current to the same hardened standard.

TRUST IN EVERY PHASE OF THE SDLC

Codesafely with agents

• Chainguard Agent Skills
• Chainguard Workspaces
• Chainguard Harness

Build with trusted artifacts

• Chainguard Containers
• Chainguard Libraries
• Chainguard VMs
• Chainguard OS Packages

Ship through trusted CI

• Chainguard Actions
• Chainguard Checks

Powered by Chainguard Factory

An agentic software factory run by open source experts.

Why the Factory earns its trust

Every layer of the supply chain has its own attack surface. The Factory applies a specific control to each.

Security Features

1. SHA-pinned source inputs: Every build starts with an immutable SHA reference to the upstream source.
2. Cryptographic verification end-to-end: We sign every artifact we ship, and any tampering breaks the signature.
3. Built from source in an isolated environment: Rebuilt from source in an isolated SLSA L3 environment.
4. Supervisor / guest separation: Privileged orchestration code is isolated from untrusted upstream code during builds.
5. Bitwise reproducibility: Each image is rebuilt with a separate apko toolchain for detection against compromises.
6. Production hygiene: Stolen credentials become useless quickly, with security measures against unauthorized access.

Where Chainguard fits into your stack and SDLC

• Chainguard Containers
• Chainguard Libraries
• Chainguard VMs
• Chainguard OS Packages
• Chainguard Actions
• Chainguard Agent Skills

Results that speak for themselves

A secure foundation for software development and deployment

• Engineering Hours Saved: 352,000+
• CVEs Remediated: 88,000+
• Average remediation time for critical CVEs: 20 hours
• Reduction in Attack Surface: 80%
• Average Reduction in CVEs: 97.6%

Start building with Chainguard

Talk to an expert