Chainguard Hits 1 Billion Container Build Manifests: What the Numbers Mean for Software Supply Chain Security

Key points

• Chainguard reported passing 1 billion container build manifests in the last six months, up from 500 million.
• The company's catalog now holds more than 3,000 unique container images and 675,000 image versions.
• The scale increase forced a rebuild of the internal systems that produce and track secure images.
• Container build manifests are the recipes that describe how a piece of software is assembled, and they matter for tracing what is inside the code companies run.

Chainguard, a company that sells pre-hardened building blocks for cloud software, says it has crossed 1 billion container build manifests produced. Six months ago that figure sat at 500 million.

The milestone was shared by the company and picked up by The Hacker News. On its face it is a vanity metric. Look closer and it is a story about what modern software supply chain security actually costs to run.

What is a build manifest, in plain English?

A build manifest is a written recipe for a piece of software. It lists every ingredient, the version of each ingredient, and the order they were combined in. When a company runs software in the cloud, that recipe is what lets security teams answer the question "what exactly is inside this thing we are running?"

Containers are the standard packaging for cloud software today. Think of a container as a sealed lunchbox holding an application and everything it needs to run. The manifest is the label on the lunchbox.

Chainguard's business is producing containers that are stripped down, patched, and rebuilt constantly so customers inherit fewer known flaws. Each rebuild generates a new manifest. A billion of them means a lot of rebuilding.

Why does the scale matter?

Scale matters because security only works if it keeps pace with change. A container image that was clean on Monday can contain a newly disclosed vulnerability by Friday. If the rebuild pipeline is slow, customers sit exposed.

Chainguard's catalog now covers more than 3,000 unique container images across 675,000 versions. That version count is the tell. It means the same image is being rebuilt again and again as upstream code and security fixes land.

Here are the headline figures in one place.

Why this touches policy, not just engineering

Regulators have spent the last three years pushing companies to know what is inside their software. In the United States, Executive Order 14028 in May 2021 directed federal agencies to require a Software Bill of Materials, a machine-readable inventory of software components, from their suppliers. In the European Union, the Cyber Resilience Act, which entered into force in December 2024, imposes similar ingredient-listing duties on manufacturers of products with digital elements, with the main obligations applying from December 2027.

Build manifests are one of the raw inputs that make a Software Bill of Materials possible. If a supplier cannot produce a reliable manifest at speed, it cannot produce a reliable inventory at speed either. That is the regulatory subtext under Chainguard's number.

The company has not published a final white paper on the rebuild of its internal systems, only a summary post. Detailed claims about throughput and provenance should be read against that caveat.

What should a buyer take from this?

Buyers should treat the figure as evidence of pipeline capacity, not as a guarantee of security outcomes. A billion manifests proves the machinery works. It does not prove any given image is free of flaws on any given day.

Procurement teams evaluating secure-base-image vendors should ask three concrete questions: how quickly a newly disclosed vulnerability moves from public disclosure to patched image, whether signed provenance is produced for every build, and whether the vendor's manifests plug cleanly into the buyer's own inventory tooling.

Those are the questions that turn a headline number into a purchasing decision.