Guarded Entrypoint examples
Example Custom Assembly manifests that use Guarded Entrypoint to inject secrets, wait for a dependency, override a …
For the complete documentation index, see llms.txt.
Note: Chainguard OS Packages is in beta. Contact your Chainguard account team to enable it for your organization.
Chainguard OS Packages expands the packages available to your private APK repository by giving you access to the full set of 30,000 enterprise-grade, zero-CVE packages built as part of Chainguard OS and Wolfi. It also includes a small set of Chainguard base images, for example, chainguard-base.
Chainguard OS Packages is designed for larger customers who already build their own images from packages using tools like Bazel, Dockerfiles, and rules_apko, and want to use a wider set of packages from Chainguard. Because you are creating custom builds, you are responsible for the image builds, the build tooling, validation, and compatibility. You still benefit from the fact that Chainguard builds the packages in the Chainguard Factory with complete SBOMs and our standard enterprise-grade, zero-CVE process.
If you need to achieve FIPS compliance, the FIPS variant of Chainguard OS Packages includes access packages with the latest versions of Chainguard’s FIPS-validated modules.
Chainguard OS Packages is not compatible with Chainguard Custom Assembly.
Example Custom Assembly manifests that use Guarded Entrypoint to inject secrets, wait for a dependency, override a …
What the Guarded Entrypoint wrapper connects to, what it never does, and what is visible in the image configuration.
What the Guarded Entrypoint wrapper does at container start: secret references, fail mode, preflight checks, command …
How to recover a container that fails to start under Guarded Entrypoint, what the wrapper's exit codes mean, and how a …
Scan a repository for container image references and see which Chainguard container images replace them, and whether …
Last updated: 2026-09-28 14:00