Supply Chain Security 101

Everything you need to know about software supply chain security in the age of open source.

DevSecOps

How to scale DevSecOps automation with shared workflows

A merged update PR isn’t a fix in production. Decide which DevSecOps automation to share, who owns each part, and how to pilot it before adding teams.

MCP security: How to evaluate an MCP server before rollout

A legitimate MCP server can still return malicious instructions. This MCP security guide shows how to scope its access and test what an assistant can send.

Compliance

FedRAMP compliance: How cloud providers earn and maintain certification

Learn FedRAMP requirements, certification paths, and the 2026 vulnerability rules, plus how maintained container images reduce the CVEs your team must manage.

What is FIPS? A guide to compliance and verification

Learn who needs FIPS compliance, why a validated module alone isn't enough, and what to verify in containers after the FIPS 140-3 transition.

Understanding FIPS: Standards, validation, and compliance

Learn what FIPS is, who needs FIPS validation, how CMVP validation works, and what approved algorithms and cryptographic boundaries mean for compliance.

CMMC 2.0 practices and domains

See all 14 CMMC 2.0 practice domains, how practices are named and numbered, and how Level 1's 17 and Level 2's 110 practices map to NIST SP 800-171.

Tools & Buyer’s Guides

8 container security tools compared: Features, tradeoffs, and pricing

Which container security tools fit your stack? Compare eight options by features, drawbacks, pricing, and the maintenance work your team still needs to handle.

Software Supply Chain

What is Wolfi? Overview and FAQ

Wolfi is a minimal, glibc-based Linux undistro built for containers. Learn how it compares to Alpine, its key features, and how to get started.

What is Octo STS? Overview and FAQ

Octo STS replaces long-lived GitHub personal access tokens with short-lived, OIDC-federated tokens. Learn how it works, trust policies, and common use cases.

What is melange? Overview and FAQ

melange builds apk packages from source using declarative YAML pipelines. Learn how it works, how it handles multi-arch builds, and how it pairs with apko.

What are containers?

Learn what containers are, how they differ from virtual machines, what's inside a container image, and how minimal base images reduce size and CVEs.

What are CIS Benchmarks?

Learn what CIS Benchmarks are, how Level 1 and Level 2 profiles work, and how the CIS Docker Benchmark applies to hardening container images for compliance.

Start building with Chainguard

Work email Talk to an expert