Chainguard Registry vs Quay

Chainguard Registry provides Chainguard Containers: minimal container images rebuilt from source daily. Its directory lists 3,115 projects and 735,898 images. Chainguard says images are continuously built in SLSA L3 hardened infrastructure with CVE patching, and lists Sigstore-signed artifacts with build-time SBOMs and digital attestations. The free offer allows up to five images per organization; the FAQ describes a freely available set of about 50 images, limited to:latest tags and without a CVE remediation SLA. Catalog plans include upstream-supported major and minor tags, contractual remediation timelines of seven days for critical vulnerabilities and 14 days for other listed severity levels, and requests for new images. Catalog features also include automated Custom Assembly tooling, a private APK repository with more than 10,000 packages, and STIG-hardened and FIPS-validated images. Images can be pulled from Chainguard or mirrored to listed artifact managers. Chainguard lists compatibility with multiple scanners. Free Images costs nothing; Catalog is priced on request. The product runs on Linux, self-hosted, and web environments.

Quay is an open-source registry for building, organizing, distributing, and deploying container images and OCI artifacts. It offers a web interface with private repositories and controls over who can view or change content. You can run it as a standalone component or as an Operator on OpenShift Container Platform; Kubernetes deployments are also supported. Clair scans images for known vulnerabilities and can suggest remediation. For distribution, Quay supports repository mirroring, multi-region replication with client failover, and disconnected environments. CI/CD and Git-compatible integrations, including GitHub, GitLab, and Bitbucket, can automate builds and deployments. An OAuth 2 REST API supports registry management and task automation. Security capabilities include TLS, isolated builds, team and organization role-based access, and encryption of sensitive fields at rest and at runtime. The open-source community distribution costs nothing under an Apache 2 license. Deployments require image storage, a database, and Redis; local image storage is intended only for proof-of-concept or test installations.