Migration on

Find Chainguard replacements with chainctl images discover

Fri, 02 Oct 2026 00:00:00 +0000

chainctl images discover reads the image references in a directory, such as a repository checkout, and reports the Chainguard Container that replaces each upstream image. For each replacement, it also tells you whether your organization can pull it today. Use it to size a migration before you start, or to find what’s left after one.

The command only reports. It doesn’t edit any files. To get replacements suggested on pull requests as images are introduced, enable Guardener container image suggestions. To convert a Dockerfile, use the Dockerfile Converter.

Migrate a .NET application to Chainguard Containers

Wed, 05 Nov 2025 00:00:00 +0000

Chainguard’s .NET container images provide a security-hardened foundation for building and running applications with significantly fewer vulnerabilities than .NET images provided by Microsoft. Chainguard’s .NET container images maintain full .NET compatibility while dramatically reducing the attack surface.

This guide demonstrates migrating a .NET application from Microsoft’s official images to Chainguard’s .NET container images by building one application with two different Dockerfiles and comparing the results side by side. This guide also highlights concrete examples of the security improvements resulting from migrating to Chainguard Containers.

Image Matcher overview

Tue, 26 May 2026 00:00:00 +0000

The Chainguard Image Matcher is an API-based tool that analyzes the software bill of materials (SBOM) of an existing container image and returns a ranked list of Chainguard images that most closely match it. It is designed to support migration workflows where you know what you are running today and want to find the best Chainguard equivalent.

How it works

You supply an SBOM for your current image, along with the source Linux distribution. The Image Matcher maps the packages in your SBOM to Chainguard APK packages, scores each candidate Chainguard image based on how well its contents cover your requirements, and returns a ranked list of recommendations with confidence scores.

Migrate a Java application to Chainguard Containers

Tue, 02 Apr 2024 15:21:01 +0000

Chainguard’s Java containers fill the same roles as the Java base images found on Docker Hub, such as eclipse-temurin and maven, but are built on Wolfi with a much smaller package set. Chainguard builds its own JDK from source in Wolfi, and rebuilds these containers nightly so security patches land without manual intervention. Porting a Dockerfile takes a handful of changes, mostly around the non-root user and the absent shell, which Differences from the Java images on Docker Hub covers in full. For current CVE data on a specific container and tag, refer to the JRE entry in the Chainguard Containers directory.

Find a matching Chainguard image using the API

Tue, 26 May 2026 00:00:00 +0000

This guide walks through calling the Chainguard Image Matcher API to find the best Chainguard equivalent for an existing container image. It assumes you already have an SBOM for the image you want to migrate.

For background on how the matcher works and how it scores recommendations, refer to Image Matcher overview.

Prerequisites

Before getting started, you will need:

Migrate a Node.js application to Chainguard Containers

Thu, 09 May 2024 15:56:52 -0700

Chainguard’s Node.js container images offer a streamlined migration path for applications seeking enhanced security posture through minimal, distroless design. Built on Wolfi, they include only the packages your application needs, which keeps both the attack surface and the image size small. Daily automated builds ensure your applications always have the latest security patches without manual intervention. For current CVE data on each image and tag, see the Node entry in the Chainguard Containers directory.

Migrate a PHP application to Chainguard Containers

Thu, 04 Apr 2024 15:56:52 -0700

Chainguard’s PHP container images provide enhanced security for PHP applications through minimal, purpose-built images that reduce attack surface. Based on Wolfi, they include only the packages your application needs, while maintaining full compatibility with PHP workloads. Daily automated builds deliver the latest security patches without manual intervention. For current CVE data on each PHP image and tag, see the PHP entry in the Chainguard Containers directory.

This article will assist you in the process of migrating your existing PHP Dockerfiles to leverage the benefits of Chainguard Containers, including a smaller attack surface and a more secure application footprint.

Guardener container image suggestions

Fri, 02 Oct 2026 00:00:00 +0000

The container image suggestions feature reviews pull requests that add or change container image references, and recommends the Chainguard Container that replaces each upstream image. Where it can, Guardener includes the replacement as a one-click suggested change.

Note: Guardener is in beta. Available to organizations that have installed and linked the Guardener GitHub App.

Image suggestions catch upstream images as they are introduced. They don’t review the images a repository already uses: only the lines a pull request adds or changes are read. To find replacements for every image in a repository, run chainctl images discover.

Migrate a Python application to Chainguard Containers

Thu, 02 May 2024 15:06:00 -0700

Chainguard’s Python containers provide a migration path to significantly reduce vulnerabilities in Python applications while maintaining full compatibility with existing workloads. This guide explains how to migrate your containerized Python applications to benefit from Chainguard’s enhanced security posture and daily updates.

Chainguard Containers are built on Wolfi, a distroless Linux distribution designed for security and a reduced attack surface. Chainguard Containers are smaller and have few or no CVEs. Our Chainguard Containers for Python are built nightly for extra freshness, so they’re always up-to-date with the latest remediations.