What you are evaluating
Check artifact compatibility, update availability, and provenance policy. Hardened base artifacts do not replace static analysis of first-party application code or composition analysis of the dependencies added by that application. Provenance describes origin and build evidence, not freedom from bugs.
A useful evaluation context
A plausible evaluation context is a team that wants fewer CVEs in base images and verifiable provenance, and must still operate application scanners on its own code.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Hardened containers, libraries, and virtual machines rebuilt from source rather than resold as generic upstream images.
- SBOM emitted with those artifacts for inventory and later disclosure matching.
- SLSA-style provenance from factory builds, including vendor-described SLSA L3-style builds of hardened open-source software.
Where it fits in the work
- Replace a lab application's base image or library with a Chainguard artifact where compatibility allows, and record rebuild lag if the team pins versions.
- Verify the attached SBOM and provenance, including digest, expected signer, and a negative test with an unexpected identity.
- Keep SAST on first-party application code and SCA on third-party dependencies included in the application; a hardened base image replaces neither check.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In a throwaway registry you own, pull a Chainguard base image for a synthetic app, generate or retrieve its SBOM and provenance, keep a first-party seeded flaw in application code, and include a pinned third-party dependency.
Evidence to look for
The artifact digest verifies against the expected signer, an unexpected signer fails admission, the SBOM lists the rebuilt components, SAST still finds the first-party flaw, and SCA still examines the included third-party dependency.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Are Chainguard images compatible with the application's required packages, users, and entrypoints?
- How is rebuild lag handled when upstream ships a fix the factory has not yet rebuilt?
- What SAST of first-party code and SCA of included third-party dependencies still run after the base image is replaced?
Names you may encounter: Chainguard Images. Historical names do not establish current availability or feature equivalence.