Configuration on

Guarded Entrypoint examples

Tue, 06 Oct 2026 17:41:00 +0000

Note: Guarded Entrypoint is in beta. To use it, contact Chainguard customer support to enable it for your organization.

This page has four example manifests for Guarded Entrypoint. Each one is a complete manifest for chainctl images repos build edit or chainctl images repos build apply. None of them contains a literal secret. Each secret is a reference that the wrapper resolves when the container starts.

Applying a manifest replaces the repo’s stored configuration. If your repo already has other customizations, such as packages, add the Guarded Entrypoint keys to your existing manifest instead of replacing it.

Managing Chainguard App connections

Mon, 03 Aug 2026 00:00:00 +0000

Guardener acts on your GitHub repositories on behalf of your Chainguard organization. The bridge between the two is a connection: a Chainguard App installation on a GitHub organization, linked to a Chainguard organization. This page explains how connections work and how to set up, inspect, change, and remove them.

For a first-time walkthrough, refer to Getting started. This page is the fuller reference for managing connections over time.

Note: Guardener is in beta. Available to organizations that have installed and linked the Chainguard App.

Configuring Guardener

Wed, 08 Jul 2026 00:00:00 +0000

Guardener is configured entirely through files committed to a .chainguard/ directory — either in each repository, or once at the organization level in your .github repository. This page explains the configuration model that all Guardener features share. For the specific options of each feature, refer to its dedicated page.

The `.chainguard/` directory

Guardener reads its configuration from the .chainguard/ directory at the root of each repository. Every feature has its own file:

Guarded Entrypoint for Custom Assembly