Chainguard Containers on Chainguard Starter

Chainguard Starter is a way to try production-grade Chainguard Containers for free, without committing to a full subscription. It lets you choose a set of five container images from the broader Chainguard catalog so you can validate security, performance, and operational fit in your own environment before you buy.

Note: Chainguard Starter is in beta.

Starter is a free plan. Besides the five container images this page covers, it includes Chainguard Libraries, Chainguard Checks, Chainguard Workspaces, and Guardener. For everything Starter includes, refer to Chainguard plans.

To sign up for Starter, follow the steps on this page. Once set up, you can start piloting up to five secure container images from the Chainguard catalog.

What Starter includes from Chainguard Containers

With Starter, users can choose any five non-FIPS images from our catalog of secure-by-default containers. Any Helm charts that depend on those images are included and count toward the five-image limit.

Starter is designed as a standalone free plan, separate from paid Catalog or per-image subscriptions. It’s meant for teams who want to try Chainguard Containers in real workloads before committing to a larger rollout, giving them a better understanding of how Chainguard’s hardened images and CVE posture behave in practice.

Note: Starter is best suited for small teams to get them started right away. When you are ready to standardize on Chainguard and deploy organization-wide, we have several paid plans that provide unlimited user access to the Chainguard Containers and additional features like Custom Assembly, FIPS images, EOL/EmeritOSS image versions, a contractual CVE-remediation SLA, and dedicated support.

Sign up for Chainguard Starter

1. Sign up and select your images

1. Go to console.chainguard.dev/signup.
2. Sign up with an email address, or click Continue with Google, Continue with GitHub, or Continue with GitLab. A work email address, including a Google account on your company’s domain, creates a verified organization named after your email domain. A personal email address, such as a Gmail address, or a GitHub or GitLab sign-in, creates an unverified organization, which you can verify later.
3. Click Set up an organization, then click Set up Starter organization.
4. Complete the form, which asks for your name and job title, and for an organization name if your organization is unverified.
5. Click Create Chainguard Starter organization.
6. Click Select images, choose between one and five images, and confirm your selection. You can also go to the Images page later to add images until you have five. Once you confirm an image, it can’t be swapped or replaced for the life of the free plan.

Once you’ve added all five images, a prompt directs you to contact Chainguard if you need access to additional images.

2. Integrate with your registry and pipelines

After you complete signup, you’re free to use the five images you selected however you like. For example, you can pull them into your CI/CD pipelines and runtime environments, or pull them through a third-party registry like JFrog Artifactory. These container images are the same as those provided to Chainguard’s paying customers, and are covered by Chainguard’s standard hardening, rebuild, and CVE-remediation processes, although they are not covered by Chainguard’s CVE SLA.

Authenticate CI pipelines with a pull token

Because Starter organizations can’t create assumable identities, CI pipelines authenticate with a pull token. Create one with chainctl:

chainctl auth pull-token create --output=env

This sets CHAINGUARD_IDENTITY_ID to the username and CHAINGUARD_TOKEN to the password. Store both as secrets in your CI platform, then log in to cgr.dev with them. For example, in a GitHub Actions workflow:

name: Pull a Chainguard container

on:
  push:
    branches: ['main']

permissions:
  contents: read

jobs:
  pull:
    runs-on: ubuntu-latest
    steps:
      - name: Log in to cgr.dev
        env:
          CHAINGUARD_IDENTITY_ID: ${{ secrets.CHAINGUARD_IDENTITY_ID }}
          CHAINGUARD_TOKEN: ${{ secrets.CHAINGUARD_TOKEN }}
        run: |
          echo "$CHAINGUARD_TOKEN" | docker login cgr.dev \
            --username "$CHAINGUARD_IDENTITY_ID" --password-stdin
      - run: docker pull cgr.dev/$ORGANIZATION/python:latest

This workflow doesn’t need the id-token: write permission, because it federates no OIDC token.

Pull tokens expire. The default lifetime is 30 days and the maximum is one year (--ttl=8760h), so rotate the secret before it expires. Refer to Authenticate to Chainguard’s Registry for the rest of the pull token options.

3. Upgrade when you’re ready

After trying out Chainguard Containers with Starter, you can upgrade to the paid Chainguard Team plan yourself, with chainctl. Team raises the Starter limits and lets you swap images. Refer to Upgrade to Chainguard Team.

For more images or features such as FIPS images, reach out to our sales team about one of Chainguard’s other paid plans:

• Catalog pricing — a subscription that grants broad access to the full Chainguard Containers catalog with self-service provisioning through the Console.
• Per-image pricing — a scoped set of images licensed individually, often used for tightly defined image deployments.

Moving to a paid plan means moving off Starter; the free five-image entitlement is not stacked on top of a paid subscription.

Manage Starter with chainctl

As an alternative to the Console, you can sign up for and manage Starter from the command line with chainctl. For the full sign-up flow, including signing up from a script or a coding agent, refer to Sign up for Chainguard Starter.

Sign up with chainctl

To sign up for a new account, run the interactive chainctl starter init command:

chainctl starter init

This requires selection of a valid authentication option:

    Choose an identity provider to login to Chainguard

  > Email and password
    Google
    GitHub
    GitLab

Use the arrow keys and press Enter to select an option, which launches a browser window to the Chainguard Console to complete sign-up. A GitHub or GitLab sign-in uses the account’s verified primary email address. A personal address creates an unverified organization, which you name yourself.

Request access with chainctl

If your company already has a Starter organization, request access to it with chainctl starter request-access:

chainctl starter request-access

Add images with chainctl

You can see which images are available using the Chainguard Directory. To add one or more images, run chainctl starter add-images, substituting the desired image names for the variables:

chainctl starter add-images $IMAGE1 [$IMAGE2 ...]

After the Chainguard system has processed your request, the images become accessible. This can take up to a few hours. When available, you can pull the images like this, replacing $ORGANIZATION with your organization’s name, or with its ID if you created it with a personal email address, and $IMAGE with the desired image’s name:

docker pull cgr.dev/$ORGANIZATION/$IMAGE:latest

Check status with chainctl

To show the status of your Starter organization, including the registry path, account provisioning status, image quota usage, and per-image readiness, run chainctl starter status:

chainctl starter status

Plan limitations and terms

Starter allows users to try out Chainguard Containers, but it comes with certain limitations, including the following:

• You can select up to five non-FIPS images. Once chosen, these images cannot be swapped or replaced during the lifetime of the free plan.
• The following types of Chainguard Containers are not included in the Starter plan:
  • FIPS-validated images
  • Images that fall under the EOL grace period
  • Images whose software is part of Chainguard EmeritOSS
• Teams using Starter will not have access to the support services available to paying customers: they will not be added to Chainguard’s support platform, be able to create support tickets, or have access to root cause analysis (RCA).
  • Starter users will still have access to Chainguard resources like our documentation, courses, the Community Slack channel, and the public support knowledge base.
• Chainguard’s CVE SLA does not apply to container images obtained through Starter.
• If your organization uses Chainguard Libraries, its cooldown period is fixed at 7 days. You can’t change it, and you can’t add an override that lets a package version skip the cooldown.
• User management is limited. An organization created with a personal email address can’t invite anyone yet. Otherwise, you can invite colleagues and remove members, but you can’t create role-bindings, so you can’t grant custom roles. An invite can give only a role whose permissions you also have. Everyone in your organization uses the same five images.
• The user who creates a Starter organization gets the limited_owner role, which lets them browse the Console, pull images, create pull tokens, invite colleagues whose email address is in your organization’s domain or one of its subdomains, and remove members. It doesn’t include access to features like Custom Assembly.
• You can create pull tokens, but not assumable identities. A pull token is the only credential a Starter organization can issue for automation. If you try to create any other identity, the request fails with starter organizations are not allowed to create identities.
• The setup-chainctl GitHub Action doesn’t work with Starter. It authenticates by assuming a Chainguard identity with the OIDC token GitHub issues to the workflow, and it has no pull token mode. The same applies to the OIDC federation examples for GitLab, CircleCI, Buildkite, Jenkins, and Kubernetes. Authenticate your pipelines with a pull token instead, as described in Authenticate CI pipelines with a pull token.
• Revoking a pull token takes a different path. On the Console’s Access Tokens page, the Delete and Edit actions are unavailable, and chainctl iam identity delete fails, because the limited_owner role can’t delete identities. To revoke a token, delete its role binding instead: run chainctl iam role-bindings list to find the binding, then chainctl iam role-bindings delete <role-binding-id>. This removes the token’s access, although the identity itself remains in the list.
• Neither Custom Assembly nor Commercial Builds, Chainguard’s bespoke paid build services, are included in the Starter plan.
• Starter cannot be combined with an existing Chainguard Containers license. Existing customers remain on their current paid plans; this free offering can’t be used to subsidize or partially offset paid image counts.

Frequently asked questions

Can I change my five images after I select them?

No. Once you’ve selected your five images under Starter, that selection is fixed for the life of the free plan and cannot be swapped or replaced.

If you anticipate needing different images over time, we recommend talking to our team about Catalog Pricing or per-image licensing.

Does Starter include FIPS images or Chainguard commercial builds?

No. FIPS images and Chainguard Commercial Builds are not included in the Starter plan.

If you require FIPS-validated images or dedicated commercial build work, you’ll need a paid plan that includes those capabilities.

Can I use Chainguard’s GitHub Action with Starter?

No. The setup-chainctl action federates a GitHub OIDC token into a Chainguard assumable identity, and Starter organizations can’t create assumable identities. Log in to cgr.dev with a pull token instead, as described in Authenticate CI pipelines with a pull token.

Can my colleagues and I use the same images?

Yes. Everyone in a Starter organization uses the same five images, and no one can swap them.

Anyone with the limited_owner role can invite a colleague whose email address is in the organization’s domain or one of its subdomains. The viewer role is enough to pull images. Replace $ORGANIZATION with your organization’s name and $EMAIL with your colleague’s email address:

chainctl iam invite create $ORGANIZATION --role viewer --email $EMAIL

To let your colleague invite others too, use --role limited_owner instead. That role also manages your organization’s billing.

If a Starter organization already exists for your email domain, you can also ask to join it. In the Console, click Request access, or run chainctl starter request-access. The request goes by email to everyone with the owner or limited_owner role in the organization. The link in that email invites you with the viewer role.

I’m already a Chainguard Containers customer. Can I add Chainguard Starter to my account?

No. Starter is a distinct, standalone free plan meant for new organizations. It can’t be combined with existing licenses or used to “carve out” a subset of images from a current subscription.

If you try to sign up using an email domain already associated with a paid Chainguard account, you’ll receive an error message. Contact your Chainguard account administrator for access to your organization’s existing account.

Can I use Starter to cover some of the images I need?

No. Starter is not a discount instrument for larger deployments. You can’t, for example, license 10 images but expect to pay for only five by applying this plan to the rest.

If you know you’ll need more than five images, it’s usually better to start with Catalog Pricing or per-image licensing so you can scale cleanly.

Can I sign up with Google, GitHub, or GitLab?

Yes. A work email address, including a Google account on your company’s domain, creates a verified organization. A GitHub or GitLab sign-in, or a personal email address such as a Gmail address, creates an unverified organization, which you can verify later.

You can also sign up from the command line with chainctl starter init, as described in Sign up with chainctl.

What happens if I decide to upgrade to a paid plan?

If you upgrade to Chainguard Team, your organization keeps its images and members and gets Team’s limits. Refer to What changes when you upgrade.

When you upgrade to another paid plan through Chainguard’s sales team:

• Your organization moves off the free Starter plan.
• You gain access to the broader capabilities of your chosen paid tier (for example, full Catalog Pricing with self-service provisioning and, optionally, FIPS access), as well as Chainguard’s full support services and CVE SLA.
• Pricing is based on the paid plan’s terms (such as developer bands for Catalog Pricing or image counts for per-image plans).

Our team will work with you to map the images you chose on Starter into the right long-term structure.