Guarded Entrypoint for Custom Assembly on

How Guarded Entrypoint works

Tue, 06 Oct 2026 17:41:00 +0000

Note: Guarded Entrypoint is in beta. To use it, contact Chainguard customer support to enable it for your organization.

This page describes what the Guarded Entrypoint binary does when a container starts. The page calls the binary the wrapper. To turn Guarded Entrypoint on, see Guarded Entrypoint for Custom Assembly.

What the wrapper does

When you turn on Guarded Entrypoint, Chainguard rebuilds the image with /usr/bin/guarded-entrypoint as the first element of its entrypoint. The image’s original entrypoint follows it. Chainguard stores your settings in environment variables in the image configuration. The names of these variables start with GUARDED_. You can see them with docker inspect. The GUARDED_ prefix is reserved, and the API rejects it in your own environment keys.

Guarded Entrypoint examples

Tue, 06 Oct 2026 17:41:00 +0000

Note: Guarded Entrypoint is in beta. To use it, contact Chainguard customer support to enable it for your organization.

This page has four example manifests for Guarded Entrypoint. Each one is a complete manifest for chainctl images repos build edit or chainctl images repos build apply. None of them contains a literal secret. Each secret is a reference that the wrapper resolves when the container starts.

Applying a manifest replaces the repo’s stored configuration. If your repo already has other customizations, such as packages, add the Guarded Entrypoint keys to your existing manifest instead of replacing it.

Troubleshoot a wrapped container

Tue, 06 Oct 2026 17:41:00 +0000

Note: Guarded Entrypoint is in beta. To use it, contact Chainguard customer support to enable it for your organization.

This page covers two kinds of problems. A container that is built with Guarded Entrypoint can fail to start. A build can also fail because Chainguard refuses to wrap an image.

First move: set GUARDED_DISABLE

When a wrapped container fails to start, set the GUARDED_DISABLE environment variable on the container and redeploy. The wrapper then starts the image’s original entrypoint and arguments without doing anything else. You don’t need to rebuild the image.

Guarded Entrypoint trust boundary

Tue, 06 Oct 2026 17:41:00 +0000

Note: Guarded Entrypoint is in beta. To use it, contact Chainguard customer support to enable it for your organization.

This page states what the Guarded Entrypoint wrapper connects to, what it never does, and what anyone who can pull your image can read.

What the wrapper connects to

The wrapper connects only to the endpoints that your configuration names: