Chainguard Registry vs Depot

Chainguard Registry provides Chainguard Containers: minimal container images rebuilt from source daily. Its directory lists 3,115 projects and 735,898 images. Chainguard says images are continuously built in SLSA L3 hardened infrastructure with CVE patching, and lists Sigstore-signed artifacts with build-time SBOMs and digital attestations. The free offer allows up to five images per organization; the FAQ describes a freely available set of about 50 images, limited to:latest tags and without a CVE remediation SLA. Catalog plans include upstream-supported major and minor tags, contractual remediation timelines of seven days for critical vulnerabilities and 14 days for other listed severity levels, and requests for new images. Catalog features also include automated Custom Assembly tooling, a private APK repository with more than 10,000 packages, and STIG-hardened and FIPS-validated images. Images can be pulled from Chainguard or mirrored to listed artifact managers. Chainguard lists compatibility with multiple scanners. Free Images costs nothing; Catalog is priced on request. The product runs on Linux, self-hosted, and web environments.

Depot provides software delivery tools spanning source control, builds, CI runners, sandboxes, caches, and registries. Its container build service is a drop-in replacement for Docker builds, with persistent caching and native x86 and Arm support. Depot CI runs existing GitHub Actions workflows as a programmable, debuggable CI service, while Depot Registry is an OCI-compliant registry for builds, pull-through caching, and other artifacts. Integrations include GitHub Actions, CircleCI, GitLab CI, Google Cloud Build, Travis CI, Bitbucket Pipelines, Buildkite, Jenkins, and AWS CodeBuild. Cache integrations cover Bazel, Go, Gradle, Maven, Pants, sccache, Nx, and Turborepo. Each build and CI run is isolated in a dedicated virtual machine. Depot says communications use TLS and storage is encrypted at rest; it also identifies SOC 2 Type 2 compliance and time-bound, permission-based debugging access. Plans start at $20 a month, billed monthly, with a 7-day trial and no free plan. Developer includes community support; Business includes Slack Connect support.