Chainguard Reviews & Product Details

The approach to security in Chainguard product is a gamechanger. It enables developers and engineering to focus on the work that really matters while relying on Chainguard to cover all our security concerns around images and libraries and with trust that any vulnerability found will be resolve quickly allowing us to comply with all our policies. Review collected by and hosted on G2.com.

Not many downside, they keep adding support for new images, charts and libraries in many languages, so any missing ends up being supported in some time. Review collected by and hosted on G2.com.

The overall offering follows a solid, consumer-friendly pattern: there is enough basic information available to get initial insights, and then a fully detailed level of information behind the paywall (which is fine, since that is their product). The web interface and the console interface for searching, viewing, and deep-diving into their deliverables are really good and work like a charm. The overview, as well as the integration into our artifact management system, was about as easy as it could be.

From a pricing perspective, it would not be realistic to do this on your own at lower cost, and building up the required expertise would already overwhelm most companies.

Regarding onboarding, support, and help, we even had a dedicated person during the first weeks, before it switched over to the standard support channels. Review collected by and hosted on G2.com.

Right now, the focus seems to be on containers and Helm charts. Adding some attention to bare VM images as well would be very beneficial. Review collected by and hosted on G2.com.

At first, I assumed it would be more like, “oh, they’ll make my life easier with CVEs.” But after using the service, I’ve found the real strength is the ability to build custom images that include the packages and libraries you actually need. In a lot of architectures you end up with plenty of one-off images, and with Chainguard you can replace those with their CVE-hardened versions. Review collected by and hosted on G2.com.

This isn’t a complaint, and I know it’s already on their roadmap, but I’d really like to see STIG and FIPS VMs offered in addition to their container images. That would help a lot with on-prem infrastructure, especially if I could swap out all the OSs on my bare-metal servers and OpenStack VMs. Review collected by and hosted on G2.com.

Secure based container image, interestingly it has vast variety of the pre-built images from database like Postgres, MySQL to language like Java, Go, Python and Node. Images are very small, also difference between dev image for building and image to run in production very secure. Review collected by and hosted on G2.com.

Sometimes it’s very hard to port an Ubuntu-based image to Chainguard. Support also feels a little pricey for what you get. Review collected by and hosted on G2.com.

What stands out most about Chainguard is the combination of technical excellence, operational maturity, and customer obsession that is rarely found in a single platform.

First and foremost, the breadth and depth of their image catalog is exceptional. Chainguard provides one of the most comprehensive collections of secure, minimal, and production-ready container images available today. The catalog covers a wide range of modern workloads and significantly reduces the operational burden of building, maintaining, and securing custom base images internally.

Equally impressive is their flexibility. When an image is not already available in the catalog, the Chainguard team demonstrates a willingness to engage directly with customers and evaluate adding new images based on real-world requirements. This level of responsiveness transforms the relationship from that of a traditional vendor into a true engineering partnership.

From a security and reliability perspective, the quality of the images themselves is outstanding. The images are thoughtfully curated, continuously maintained, and designed with a strong security-first philosophy. They provide a substantial reduction in vulnerability exposure while preserving compatibility and operational simplicity. For organizations focused on supply chain security, compliance, and reducing risk, Chainguard represents a significant advancement over traditional container image strategies.

The API they offer is also robust and very polished with a ton of features that are much needed from an operational standpoint that are often not present with other vendors. Chainguard has also curated many helpful tools to help with the process as well.

The customer experience is equally noteworthy. Their onboarding process is among the best I have encountered. The team is highly knowledgeable, responsive, and capable of engaging at both strategic and deeply technical levels. Whether discussing platform architecture, implementation details, or organizational adoption, they consistently demonstrate expertise and a genuine commitment to customer success.

The user experience deserves special recognition as well. The platform's UI and UX are exceptionally well designed—clean, intuitive, and efficient. Complex security and image management workflows are presented in a way that is approachable without sacrificing depth or functionality. It is clear that significant attention has been invested in making the platform easy to navigate and operationalize at scale.

Overall, Chainguard has built a platform that excels across the dimensions that matter most to modern platform engineering and SRE organizations: security, reliability, usability, scalability, and customer partnership. Their extensive image ecosystem, willingness to adapt to customer needs, world-class support organization, and polished user experience make them one of the strongest solutions available for securing and managing containerized workloads. Review collected by and hosted on G2.com.

There are no real downsides to using chainguard that I've experienced. Review collected by and hosted on G2.com.

We use the Chainguard FIPs containers for compliance with some of our government customers. It is relatively seamless to plug-and-play our applications into the Chainguard FIPs image and have it just work. We integrate the Chainguard repo into our Jfrog artifactory and that makes the docker image pull process pretty consistent across the other processes at our company. Review collected by and hosted on G2.com.

The pricing structure is a bit harsh. The cost-per image is pretty significant and we've made some engineering mistakes where we purchased an image, realized we didn't actually need it, and just wasted a bunch of money on nothing. Review collected by and hosted on G2.com.

Chainguard's security-first approach, combined with the expertise of their engineering team, has been the most valuable aspect of our partnership. Their minimal, hardened container images and FIPS-compliant libraries have helped simplify our FedRAMP readiness efforts while reducing software supply chain risk. We also appreciate their responsiveness, technical knowledge, and willingness to work collaboratively to resolve implementation challenges and support our engineering teams. Review collected by and hosted on G2.com.

We have no significant concerns at this time and have been pleased with our overall experience working with Chainguard. Review collected by and hosted on G2.com.

As a DevSecOps engineer, the best part of Chainguard is being able to get secure, hardened container images off the shelf. Before Chainguard, I had to maintain my own images and write custom scripts to remove certain binaries, or build my own images from scratch to reduce vulnerabilities. That created a lot of toil, especially when it came to keeping everything up to date. Now I can start from images that are already designed with security in mind, which cuts down on vulnerability noise and saves me time. I don’t use the UI much, so for me the main value is the core functionality: reliable, low-vulnerability images that make secure container workflows much easier to maintain. Review collected by and hosted on G2.com.

Some images that are directly derived from other sources, like Bitnami, end up with entrypoints that differ from the originals. On top of that, some Helm charts don’t provide a way to customize the container’s ENTRYPOINT or CMD. In certain cases, this leaves me having to maintain my own image (using Chainguard’s image as a base) solely to adjust the ENTRYPOINT. Review collected by and hosted on G2.com.

Chainguard container images are very well engineered, well managed, and well supported. The company stays focused on providing meaningful, effective security, and that focus shows in the overall experience.

The images are updated promptly as vulnerabilities are resolved by product owners and communities. For example, I was tracking a particularly high-impact npm vulnerability, and our node/npm images were updated within four hours of the release of the new (remediated) npm version.

Wolfi, as a container-focused Linux distribution, is well planned and well implemented. I especially appreciate the glibc compatibility (in contrast to Alpine).

Chainguard has also done a great job developing tools and information that can be used in automated processes, rather than only being available via a web page.

Overall, I’ve appreciated the depth of knowledge on the technical team. I’ve learned a huge amount and added a significant number of security tools based on my conversations with our technical support team. The product support lead for our company has done an amazing job providing everything possible for us to be successful. Review collected by and hosted on G2.com.

The most difficult issue I’ve encountered when using the Chainguard container images is the complexity of the web pages for the container products.

My company has a specific need to use only the latest updated version within each supported product major version. Because of that, it was hard to explain to other users which label they should use. For example, I need teams to refer to images by product and major version, e.g., node:24-latest. However, the same image might also be referenced as “node:latest” or “node:24.9,” which created confusion. I ended up developing an internal dashboard to make it clearer which images to use to meet our compliance requirements.

Note: I understand that many other companies might prefer node:latest or a pinned version, so Chainguard needs to provide all the labels to give customers flexibility and choice. In our case, though, that flexibility made it harder for some of our teams to consistently select the correct option for our needs. Review collected by and hosted on G2.com.

They have the ability to execute on their mission to secure the entirety of the software supply-chain. I appreciate that they have products that cover most of our needs and are working on more to fill the gaps. Review collected by and hosted on G2.com.

Attacks on the supply-chain are such a growing problem that it’s not possible for them to move fast enough Review collected by and hosted on G2.com.