Documentation
Book a demo

Integrations

Integrating with Chainguard Containers

Chainguard, a Docker Verified Publisher, provides Chainguard Containers (previously known as Chainguard Images): minimal, hardened container images with zero CVEs, built-in SBOMs and signatures, and containing only the application and its runtime dependencies.

Proxy and cache these images in Cloudsmith by configuring a Chainguard upstream.

Chainguard provides Free container images (cgr.dev/chainguard) that are publicly available and tagged as :latest. They also provide Production container images (cgr.dev/) for versioned tags, FIPS images, and custom builds.

Upstream configuration

Form FieldDescription
NameA descriptive name for this upstream source. A shortened version of this name will be used for tagging cached packages retrieved from this upstream.
PriorityThe weighting of the Upstream source. Upstream sources are selected for resolving requests by sequential order (1..n), followed by creation date.
Proxy URLThe URL for this upstream source. This must be a fully qualified URL including any path elements required to reach the root of the repository.
Proxy OnlyProxy requests through to upstream sources in order to match assets that are not present in this repository.
Cache and ProxyProxy the initial request for an asset through to the upstream source and then store (cache) resolved assets in this repository for future requests.
Verify SSL CertificatesIf enabled, SSL certificates are verified when requests are made to this upstream. We recommend leaving this enabled for all public sources to help mitigate Man-In-The-Middle (MITM) attacks.
Authentication (optional)Optional credentials that can be provided if the upstream is not publicly accessible.
Headers (optional)Optional key-value headers that can be passed to upstreams with each request.

Adding Chainguard Containers as an upstream

You can integrate the Chainguard Containers registry into your Cloudsmith account by adding a Chainguard upstream.

Chainguard Production containers

To access Chainguard Production containers, you must configure the Chainguard registry as a private upstream using the username and password from a Chainguard pull token.

  1. In your Cloudsmith repository, go to the Sources tab.
  2. If you have existing upstreams configured, click + Configure new upstream.

    • To add pre-configured Chainguard Free containers:

      1. Select the Pre-configured tab.
      2. Select the Chainguard Containers (Free) format.

      1. Click + Add 1 upstream.

        Your Chainguard upstream appears on the Upstream registries section of the Sources tab.

    • To add Chainguard Production containers:

      1. In the modal, select the Hardened images tab.
      2. Click the Chainguard Containers (Production) card.
      1. In the Name field, enter a descriptive name for the upstream.
      2. In the Priority field, specify a priority for the upstream. For more information about upstream priority, see Upstream concepts: Priority.
      3. The Proxy URL field is pre-filled with the Chainguard registry URL: https://cgr.dev/.
      4. Under Package delivery, select Cache and proxy.
      5. Click Additional options.
      6. Under Source type, select Private.
      7. Under Authentication type, select Basic Auth and enter the username and password from a Chainguard pull token.
      8. (Optional) In the Headers section, add key-value headers to pass to the upstream with each request.
      9. Select the Verify SSL Certificates option to ensure that SSL certificates are verified.
      10. Click + Add upstream.

      Your Chainguard upstream appears on the Upstream registries section of the Sources tab.

Pull a Chainguard container image with Docker native tooling

After you've configured an upstream, you can pull Chainguard images into Cloudsmith with the docker pull command.

Pull a Chainguard Free container with Docker native tooling

To pull the nginx Chainguard Free container image into Cloudsmith:

  1. Configure a Cloudsmith upstream for Chainguard by using the steps described in Adding Chainguard Containers as an upstream.
  2. Verify that Docker is installed and running.
  3. In a terminal, log in to Docker with your Cloudsmith username and token:
    bash
    docker login docker.cloudsmith.io
  4. Pull the nginx image by running the following command:
    bash
    docker pull docker.cloudsmith.io/WORKSPACE/REPOSITORY/nginx:latest
  5. Verify that the image appears in your Cloudsmith repository.

Pull a Chainguard Production container image with Docker native tooling

To pull the nginx Chainguard Production image into Cloudsmith:

  1. Configure a Cloudsmith upstream for Chainguard by using the steps described in Adding Chainguard Containers as an upstream.
  2. Verify that Docker is installed and running.
  3. In a terminal, log in to Docker with your Cloudsmith username and token:
    bash
    docker login docker.cloudsmith.io
  4. Pull the nginx image by running the following command:
    bash
    docker pull docker.cloudsmith.io/WORKSPACE/REPOSITORY/CHAINGUARD-REGISTRY/nginx:latest
  5. Verify that the image appears in your Cloudsmith repository.