Chainguard Changelog — Announcement Demo

Note: This is a demo page — a copy of the changelog with a sample breaking change and product announcement added to the top of the most recent week, to show how these manually entered sections render. It is not the live changelog; see the Changelog.

This page logs notable Chainguard Containers lifecycle events week by week, newest first: images that entered their end-of-life grace period, images no longer available after their grace period ended, and images newly added to the catalog. Each event is listed once, in the week it first appeared.

Week of 2026-07-14

nginx images now run as a non-root user by default

The nginx images below now start as UID 65532 instead of root. Containers that bind to port 80, or write to root-owned paths, will fail to start until reconfigured.

• Affected: nginx:1.27, nginx:1.28 (and their -fips variants).
• Action: listen on port 8080 (or another port above 1024) and make any mounted paths writable by UID 65532.

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

The following images reached the end of their grace period and are no longer available:

The following images reached end-of-life and entered their grace period:

Chainguard built 21 new container images this week, including both standard and FIPS variants.

Container Policies now in open beta

Launched July 10, 2026.

Container Policies gives DevOps and security teams org-wide, policy-based control over which container images can be pulled. Three policies are available:

• no-eol — blocks pulls of end-of-life images.
• support-window — restricts pulls to long-term-support versions.
• cooldown — delays new builds for a configurable bake period (7 days by default).

Each policy runs in DRY_RUN (warn only) or ENFORCE (blocking) mode and is managed at the org level through chainctl or the API. Container Policies replaces custom scripts and third-party registry tooling with built-in guardrails, so teams no longer have to choose between taking every upstream update (and risking breaking changes) or freezing versions (and missing security fixes).

Week of 2026-07-13

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

The following images reached the end of their grace period and are no longer available:

The following images reached end-of-life and entered their grace period:

Chainguard built 1 new container image this week.

Week of 2026-07-07

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

The following images reached the end of their grace period and are no longer available:

The following images reached end-of-life and entered their grace period:

Chainguard built 6 new container images this week, including both standard and FIPS variants.

Week of 2026-07-01

Chainguard offers a grace period for eligible end-of-life images: up to six months of continued rebuilds and security updates while you complete your upgrade.

The following images reached the end of their grace period and are no longer available:

The following images reached end-of-life and entered their grace period:

Chainguard built 27 new container images this week, including both standard and FIPS variants.