Chainguard Pricing
Build software better with Chainguard
Hardened, secure, and production-ready builds of all the open source you rely on — so your teams can build faster, stay compliant, and eliminate risk.
Get a free quote
chainguard containers chainguard libraries chainguard vms chainguard actions
Select a product
Chainguard Containers
Minimal, secure-by-design container images guarded under a CVE remediation SLA
Free Images
Five images to test and deploy in production for free.
what's Included
- Up to five images per organization, spanning Base, Application, and AI/ML images.
Scoped Production Deployments
Per Image
Licensed by number and type of images (base, app, AI/ML, and FIPS).
Request Enterprise pricing
what's Included
- Contractual CVE SLA
- All upstream supported tags
wall-to-wall standardization
Catalog
Use Chainguard as the trusted source for all your container images. Licensed by size of engineering organization.
Starts at $19K for a team of 10
Request Enterprise pricing
what's Included
- Full access to 3,000+ images (and growing)
- Contractual CVE SLA
- Ability to request net new images
Chainguard Containers features
Features
| Feature | Details |
|---|---|
| Free Images | 5 images of your choice, including previous versions |
| Catalog | Full access to the Chainguard Catalog |
| Container image access | Unlimited pulls with no metering |
| Infrastructure | Continuously built from source in SLSA L3 hardened infrastructure with CVE patching |
| Artifacts | Sigstore signed artifacts with full build-time SBOMs and digital attestations |
| Reports | Build-time SBOMs, security advisory feeds, and broad scanner support |
| Version Support | All upstream supported versions, including major and minor tags (i.e., Python 3.10-3.14) |
| Console Management | Console-based user management |
| CVE SLA | Contractual CVE SLA (7 days for critical, 14 days for high/med/low) |
| Custom Assembly | Automated tooling (Custom Assembly) and access to 10K+ packages (Private APK Repo) to quickly and easily customize images |
| Hardening | Access to STIG-hardened and FIPS-validated images |
| End-of-life | Updated end-of-life images for up to 6 months with EOL Grace Period |
| Console Management | Console to manage images, entitlements, pull tokens, and more |
| New Requests | Ability to request new images or packages at no cost |
Chainguard Libraries
Malware-resistant, CVE-patched language libraries to combat supply chain attacks across Python, Java, and JavaScript
Licensed by ecosystem based on the number of developers using that language.
Get a free quote
what's Included
- Unlimited applications per language ecosystem with no metering or rate limiting for pulls
- Backported patches for certain critical and high-severity CVEs in popular Python language dependencies
- Cross-compatibility across Linux distros (ChainguardOS, RHEL, Debian, Ubuntu, and more)
Chainguard Libraries features
Features
| Feature | Details |
|---|---|
| Per Ecosystem | Full access to language dependencies for subscribed ecosystems |
| Language Libraries | Unlimited pulls with no metering |
| Build Environment | Full dependency tree continuously built from source in SLSA L3 hardened environment |
| Compatibility | Cross-compatibility across Linux distributions |
| Code Signatures | Code signatures and build receipts for every artifact |
| Console Management | Console to manage entitlements, pull tokens, and more |
| New Libraries | Ability to request new language libraries at no cost |
| Backported Patching | Backported CVE patching (Currently Python only) |
Chainguard VMs
Minimal, secure-by-design virtual machine images for all deployments
Scoped Enterprise Deployments
Per Image
Licensed by number and type of images (base, app, and container host).
Get a free quote
what's Included
- Contractual CVE SLA
- All upstream supported tags
wall-to-wall standardization
Catalog
Licensed by size of engineering organization.
Get a free quote
what's Included
- Contractual CVE SLA
- All upstream supported tags
- Full access to Chainguard’s VM catalog, including newly added images over time
Chainguard VMs features
Features
| Feature | Details |
|---|---|
| Per Image | Full access to the Chainguard Catalog |
| Virtual Machine | Virtual machine image access |
| Build Environment | Continuously built from source in SLSA L2 hardened infrastructure with CVE patching |
| CVE SLA | CVE remediation SLA (7 days for critical, 14 days for high/med/low) |
| Version Support | All upstream supported versions, including major and minor tags (i.e., Python 3.10-3.14) |
| Support | Enterprise-grade support for multi-cloud and on-prem |
| Customization | Customization capabilities using Hashicorp Packer |
| Console Management | Console to manage images, entitlements, pull tokens, and more |
Chainguard Actions
Continuously hardened GitHub Actions to protect pipelines against supply chain attacks.
Priced by compute minutes consumed, with access to the entire Actions catalog.
Get a free quote
what's Included
- A rapidly growing catalog of 1000+ of the most popular GitHub Actions with rewritten .yaml files that remove attack vectors.
- A hardening report for every action so you can see what changed and why.
- Get new GitHub Actions your team depends on added to the catalog in one business day.
Chainguard Actions features
Features
| Feature | Details |
|---|---|
| Per Ecosystem | 1000+ Actions with previous 5 versions automatically |
| Self-service Requests | Self-service actions requests w/ 1 business day SLA |
| Rehardening | Automatic rehardening for new upstream actions versions |
| Attack Protection | Automatic rehardening of the entire catalog for new attack patterns |
| Hardening Reports | Hardening.md reports for each action |
Frequently Asked Questions
Does Chainguard offer volume discounts?
Yes. Customers committed to multi-year agreements or higher usage qualify for discounts.
Does Chainguard offer multi-product discounts?
Yes. If you adopt multiple Chainguard products — containers, libraries, and virtual machines — you’ll receive bundled pricing that reduces your overall cost when compared to buying each product individually.
Does Chainguard offer startup or SMB pricing?
Yes. Startup and SMB specific pricing options are available for qualified organizations.
Does Chainguard offer government or public sector pricing?
Yes. Public sector specific pricing options are available for qualified organizations across federal, state and local, and higher education.
Is Chainguard access perpetual?
Once you mirror a Chainguard artifact to your environment, it’s yours to keep.
What integrations does Chainguard offer?
Chainguard believes in the ethos of an open ecosystem. We partner with leading open source and enterprise vulnerability scanners such as Snyk, Grype, Trivy, AWS Inspector, Wiz, GitLab, CrowdStrike, Qualys, and more.
Chainguard also integrates with popular artifact managers like JFrog Artifactory, Cloudsmith, Harbor, Nexus, Google Artifact Registry, Docker Hub, Amazon ECR, Microsoft ACR, and more.
How do you license Chainguard Containers?
Chainguard offers two licensing models for our container images: Catalog-based licensing and Per-Image licensing.
What are “free” images?
Chainguard offers a select set of ~50 container images that are freely available for developers to test and deploy. These images include only “:latest” version tags and are not covered under our CVE remediation SLA.
What types of container images Chainguard offers?
- Base: Languages and frameworks that developers build on top of (i.e., modify) for their use case.
- 3rd Party Apps: Servers, databases, CI/CD infrastructure, and dev tools, that developers drop in and use as-is.
- AI/ML: Applications that handle ML model operations and GPU-enabled computation.
- FIPS: Container images that leverage FIPS-validated encryption and OS-level STIGs.
How do you license Chainguard Libraries?
Chainguard Libraries is licensed by the size of your engineering org using a language ecosystem (currently Python, Java, and JavaScript).
What if we need a library that’s not in the Chainguard Catalog yet?
Reach out to your account team to check your current coverage for your specific environment and request prioritization if needed.
How do you license Chainguard VMs?
Chainguard offers two primary licensing models for its VM images: Catalog-based licensing and Per-Image licensing.
What types of Chainguard VMs are available?
- Container Host VMs: VMs optimized to run containers.
- Base VMs: Minimal, hardened operating system images for general use or specific language runtimes.
- Application VMs: Pre-configured images with embedded software that are ready to deploy.
- FIPS VMs: Images featuring FIPS-approved cryptography and STIG hardening for regulated environments.
Start building with Chainguard
Work email Talk to an expert