Chainguard Products Changelog

This page logs Chainguard product updates week by week, newest first: product announcements, breaking changes, container images that reached end-of-life or are no longer available, and images newly added to the catalog. Each event is listed once, in the week it first appeared.

Week of 2026-08-03

ingress-nginx-controller entrypoint, command, and default user changes

Effective July 15, 2026.

Chainguard aligned the entrypoint and command behavior of all supported ingress-nginx-controller images with the upstream image, correcting a startup configuration defect present since the image was first published in 2024. Non-iamguarded variants also changed their default runtime user from root (UID 0) to www-data (UID 101).

• Affected: all supported ingress-nginx-controller images, including FIPS and -iamguarded variants.
• Action: review any configuration that overrides command, args, entrypoint, or runAsUser, or that depends on admission policies or file ownership assumptions. Deployments using the upstream Helm chart defaults need no changes.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

Images that are no longer available

The following container images reached the end of their grace period and are no longer available:

Images that have reached end-of-life

The following container images reached end-of-life and entered their grace period:

Chainguard built 22 new container images this week, including both standard and FIPS variants.

Week of 2026-07-28

SUSE NeuVector now natively supports Chainguard Containers

Launched July 24, 2026.

SUSE’s NeuVector vulnerability scanner now natively supports Chainguard Containers and ingests Chainguard’s OSV advisory feed, which includes recent data-quality improvements. Scans of Chainguard images suppress false positives and report more accurate results.

Group-based role mapping is now generally available

Launched July 22, 2026.

Administrators can map identity provider groups — Okta or Microsoft Entra ID, for example — directly to Chainguard roles, instead of assigning roles one user at a time. Anyone who authenticates with a mapped group in their token receives that role for the session.

For more information, including setup steps, refer to Grant Chainguard Roles from Identity Provider Groups.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

Images that are no longer available

The following container images reached the end of their grace period and are no longer available:

Images that have reached end-of-life

The following container images reached end-of-life and entered their grace period:

Chainguard built 16 new container images this week, including both standard and FIPS variants.