Documentation
Book a demo

Integrations

Integrating with Chainguard Containers

Chainguard, a Docker Verified Publisher, provides Chainguard Containers (previously known as Chainguard Images): minimal, hardened container images with zero CVEs, built-in SBOMs and signatures, and containing only the application and its runtime dependencies.

Proxy and cache these images in Cloudsmith by configuring a Chainguard upstream.

Chainguard provides Free container images (cgr.dev/chainguard) that are publicly available and tagged as :latest. They also provide Production container images (cgr.dev/) for versioned tags, FIPS images, and custom builds.

Adding Chainguard Free container images

  1. Configure upstream proxying
    • Navigate to a repository and select Upstreams/Sources.
    • Click Add upstream or Configure upstream.
    • In the modal, select the Pre-configured tab.
    • Click the Chainguard Containers (Free) card, then click Add.

Adding Chainguard Production container images

  1. Configure upstream proxying

    • Navigate to a repository and select Upstreams/Sources.
    • Click Add upstream or Configure upstream.
    • In the modal, select the Manual setup tab.
    • Select Chainguard as the format.
    • Enter an upstream name, priority, and the proxy URL: https://cgr.dev/
    • Select Cache and proxy.

  2. Authentication and headers

    • Expand Additional options.
    • Select Private as the source type.
    • Enter the username and password from a Chainguard pull token.

  3. Configure SSL certificate verification

    • Select the SSL certificates checkbox to enable verification.

Pull a Chainguard container image with Docker native tooling

Example of pulling a Chainguard Nginx image after configuring the Cloudsmith upstream:

  1. Configure the Cloudsmith upstream for Chainguard using the steps above.
  2. Verify Docker is installed and running.
  3. Open a terminal.
  4. Log in to Docker using your Cloudsmith username and token:
    bash
    docker login docker.cloudsmith.io
  5. Pull the latest Chainguard nginx image by running:
    bash
    docker pull docker.cloudsmith.io/WORKSPACE/REPOSITORY/nginx:latest

    Note

    Replace WORKSPACE and REPOSITORY with the specific Cloudsmith workspace and repository names.

  6. Verify the image appears in the Cloudsmith repository.