Getting Started on

Set up Chainguard Checks and Chainguard Workspaces

Tue, 13 Oct 2026 00:00:00 +0000

Chainguard Checks runs your repository’s CI on every GitHub pull request, with each check in its own microVM. Chainguard Workspaces runs your development work, and the coding agents that do it, in a remote microVM session that holds none of your long-lived credentials. You can use either product on its own, but they’re built to work together, and you set them up together: one command, chainctl develop init, turns on both. This page explains what the products share, then walks you through signing up and giving teammates access. For how the two products isolate your code, refer to How Chainguard Checks and Chainguard Workspaces isolate your code.

What is Chainguard?

Thu, 23 Jul 2026 00:00:00 +0000

Nearly every modern application is built on open source software. That software is powerful, but it arrives with problems: vulnerabilities (including publicly disclosed CVEs), unpatched dependencies, unclear provenance, and the constant work of keeping it all up to date. Tracking and fixing these issues across a large codebase consumes engineering time that could go toward building products.

Chainguard’s mission is to be the secure source for open source. Rather than leaving you to patch and harden open source software yourself, Chainguard rebuilds it from source in a hardened build environment, keeps it continuously updated, and distributes it with the metadata you need to verify what you’re running. The result is software that carries low-to-no known CVEs and requires far less remediation work from your team.

Getting started with Guardener

Wed, 08 Jul 2026 00:00:00 +0000

This guide walks you through everything you need to start using Guardener on your GitHub repositories:

Install the Chainguard App on your GitHub organization.
Link your Chainguard organization to your GitHub organization.
Verify the link and enable your first feature.

Once the app is installed, Guardener can respond on your public repositories. Linking connects that activity to your Chainguard organization and unlocks the features that require one, such as private repository coverage — there is no separate entitlement step.

Sign up for Chainguard Starter

Tue, 03 Nov 2026 16:30:40 +0000

Chainguard Starter is Chainguard’s free self-serve plan. You sign up with chainctl starter init, which creates a Starter organization for you and, optionally, adds your first images. This page covers signing up, adding images, joining an organization that already exists, and signing up from a script or a coding agent.

Before you begin

You need the following:

Tutorial: Fix a failing check with Claude Code in a Chainguard Workspaces session

Thu, 12 Nov 2026 15:30:50 +0000

Chainguard Checks and Chainguard Workspaces are built to work together: a coding agent changes your code in a Workspaces session, run-ci runs your checks against the change before you push, and Chainguard Checks runs the same checks on the pull request. When a check fails, the agent reads why from the session and fixes it.

In this tutorial, you walk that loop once with a small Go project. You open a session, let Claude Code add a function, check the change with run-ci, and open a pull request whose checks pass. Then you break a test on purpose, push without running run-ci, read the failure from the session with chainctl checks failures, and let Claude Code fix it.

Get started with Chainguard Checks

Thu, 08 Oct 2026 00:00:00 +0000

Get a first check passing with the quick start, or learn each part in the step-by-step guide.

Quick start

Install chainctl

To install chainctl with Homebrew, run the following command:
```
brew install chainguard-dev/tap/chainctl
```
Or, to install it with curl on macOS or Linux, run the following commands:
```
curl -fL -o chainctl "https://dl.enforce.dev/chainctl/latest/chainctl_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/aarch64/arm64/')"
sudo install -o $UID -g $(id -g) -m 0755 chainctl /usr/local/bin/
```
If you already have chainctl, you need 0.2.386 or later. Update it with sudo chainctl update, or with brew upgrade chainctl if you installed it with Homebrew.
Sign up

In the root of a local clone of a GitHub repository that you can push to, run the following command:
```
chainctl develop init
```
The command creates your Chainguard organization, if you don’t have one, and turns on Chainguard Checks. When it asks which GitHub account to link, choose the one that owns your repository: press Enter for your own user, or enter the organization’s name. If the Chainguard App isn’t installed on that account, the command offers to open its installation page. Give the App access to your repository. If you installed it earlier and GitHub shows that it’s asking for more permissions, accept them. To sign in with an email address and password, first run chainctl config set default.social-login email.
Add a first check

Create a branch and a .chainguard/ci.yaml file with one check:
```
git checkout -b add-chainguard-checks
mkdir -p .chainguard
cat > .chainguard/ci.yaml <<'EOF'
version: 1
environment: {}
checks:
hello:
cmd: ls -la
EOF
```
The check lists the files in its working directory and needs no packages or network access, so it passes on any repository.
Open a pull request

Commit the file and push the branch:
```
git add .chainguard/ci.yaml
git commit -m "Add Chainguard Checks"
git push -u origin add-chainguard-checks
```
Then open a pull request, from the link that git push prints or on github.com.
Read the result

On the pull request’s Checks tab, wait for Chainguard Checks (presubmit) to appear and pass, which usually takes less than a minute. It’s the only check that Chainguard Checks adds for this file, because a check that passes without reporting anything gets no GitHub check of its own. Select it to see the run’s summary: its title reads All 1 check(s) passed, and its table lists hello as passed. If no check appears, refer to A pull request gets no checks.

To replace the first check with your own, refer to Replace the first check with your own. To move checks from your GitHub Actions workflows, refer to Migrate from GitHub Actions.

Get started with Chainguard Workspaces

Thu, 08 Oct 2026 00:00:00 +0000

A Chainguard Workspaces session is a VM on Chainguard’s infrastructure, not on your laptop, for one of your GitHub repositories. When you run chainctl develop in your repository’s directory, chainctl creates a session, syncs your checkout into it, and opens a shell in it. There you can build, test, and run Claude Code as you would on your laptop. When you detach and come back later, your files and running processes are as you left them. To learn how sessions work, including how your directory gets into one and how a session isolates your code, refer to the Chainguard Workspaces overview and How Chainguard Checks and Chainguard Workspaces isolate your code.

Quickstart for Chainguard Containers

Wed, 05 Aug 2026 00:00:00 +0000

This quickstart covers one full cycle of working with a Chainguard Container: pull an image from Chainguard’s registry, run your own code on it, and verify where it came from. The example uses the Node container, but the same workflow applies to every image in the Chainguard Containers Directory.

These steps link to reference documentation instead of explaining each concept in place. Follow the links whenever you want additional details and context.

Onboard your teams

Wed, 26 Aug 2026 00:00:00 +0000

Your organization has adopted Chainguard, and now you need to bring your teams on board. This guide explains what your teams can pull from Chainguard Containers and Chainguard Libraries, why that depends on your subscription, and how to retrieve the SBOMs and provenance that ship with every image and package.

It’s written for two readers:

Platform and security administrators who manage Chainguard for the organization and need to explain it to the teams they support. Early on, you may be the only people with Chainguard Console access, so your teams rely on you to communicate how this works.
Software engineers who were pointed here and want to know how to find and pull the resources they’re cleared to use.

To decide where to start, identify which Chainguard products your organization uses; many use both. Read Chainguard Containers if your teams pull container images, or Chainguard Libraries if they pull language dependencies for Java, Python, or JavaScript. Your administrators know which subscriptions apply.

Getting started with FIPS containers

Thu, 16 Oct 2025 08:00:00 +0000

Prerequisites

Before starting, you’ll need:

Set up Chainguard in your CI/CD pipeline

Thu, 24 Sep 2026 00:00:00 +0000

A CI/CD pipeline touches most of your software supply chain: the code you commit, the credentials your runners hold, the dependencies you pull, the image you build, and the artifact you ship. Chainguard has something to offer at each of those points.

This page walks the whole path in order so you can see how the pieces relate before you start wiring any of them up. It’s a map rather than a tutorial. Each stage gives you the one command that anchors it, then links to the guide that covers the details.

Getting started with skill hardening

Tue, 22 Sep 2026 00:00:00 +0000

Use chainctl skills harden to upload an agent skill, submit it for server-side hardening, and download the result with a report of the changes and scanner findings. You can submit a local directory or harden an artifact you have already pushed to your organization’s uploads registry.

This guide builds on Getting started with the Chainguard Skills Registry, covering hardening and job tracking before you install the skill.

Note: Chainguard Agent Skills is in beta.

Get support

Tue, 01 Sep 2026 00:00:00 +0000

When the documentation doesn’t answer your question, Chainguard offers several ways to get help. This guide covers what to check first, which channel handles your kind of request, and how to open a support ticket when you need one.

Before you open a ticket

Many questions already have a published answer you can find in seconds:

Change or reset your MFA device

Fri, 11 Sep 2026 00:00:00 +0000

You might need to move your multi-factor authentication (MFA, also called 2FA) to a new device because you replaced your phone, changed authenticator apps, or lost the device that generates your codes. Where you make that change depends on how you sign in to the Chainguard Console, because Chainguard manages MFA for only one of the sign-in paths.

The Console login screen has buttons for Google, GitHub, and GitLab, along with a single field that accepts either your email address or your organization name. What you click or enter there determines your path:

Get started with chainctl

Mon, 03 Mar 2025 08:49:15 +0000

Chainguard’s chainctl provides command-line access to manage container images, identity resources, and security configurations across your organization. This guide covers essential commands to begin using chainctl effectively in your security and DevOps workflows. For comprehensive command documentation, refer to the chainctl reference.

Authenticate and check auth status

To use chainctl, the first thing you must do is authenticate with the Chainguard platform. Do so with: