Checks and Workspaces on

Set up Chainguard Checks and Chainguard Workspaces

Tue, 13 Oct 2026 00:00:00 +0000

Chainguard Checks runs your repository’s CI on every GitHub pull request, with each check in its own microVM. Chainguard Workspaces runs your development work, and the coding agents that do it, in a remote microVM session that holds none of your long-lived credentials. You can use either product on its own, but they’re built to work together, and you set them up together: one command, chainctl develop init, turns on both. This page explains what the products share, then walks you through signing up and giving teammates access. For how the two products isolate your code, refer to How Chainguard Checks and Chainguard Workspaces isolate your code.

Tutorial: Fix a failing check with Claude Code in a Chainguard Workspaces session

Thu, 12 Nov 2026 15:30:50 +0000

Chainguard Checks and Chainguard Workspaces are built to work together: a coding agent changes your code in a Workspaces session, run-ci runs your checks against the change before you push, and Chainguard Checks runs the same checks on the pull request. When a check fails, the agent reads why from the session and fixes it.

In this tutorial, you walk that loop once with a small Go project. You open a session, let Claude Code add a function, check the change with run-ci, and open a pull request whose checks pass. Then you break a test on purpose, push without running run-ci, read the failure from the session with chainctl checks failures, and let Claude Code fix it.

How Chainguard Checks and Chainguard Workspaces isolate your code

Thu, 15 Oct 2026 12:09:53 +0000

Chainguard Checks runs your pull request checks, and Chainguard Workspaces runs your development sessions and coding agents, in microVMs that hold none of your long-lived credentials. This page collects the security model of both products in one place, for security reviewers who need to decide whether to allow them and for coding agents that need the rules. It describes how each product isolates code, where credentials come from, what code can reach on the network, who decides what a pull request gets, and how runs and sessions move through their lifecycles. A glossary at the end defines the terms both products use.