Chainguard Extends Container Security to VMs

Chainguard is turning a container security product into a broader operating system layer for old enterprise infrastructure. The key move is not just adding more images, it is taking the same rebuild, patch, SBOM, and provenance machinery used for containers and applying it to full virtual machines that teams still run on EC2, Azure, GCP, private cloud, and on premises. That lets security buyers cover modern Kubernetes workloads and older VM estates with one workflow.1 2 3

• The product split matters. Base VMs like Chainguard OS, Java, and Python give teams a hardened starting point for custom workloads, while application VMs like Jenkins, Nginx, and Squid Proxy replace specific long lived servers that often sit unpatched for months because upgrading them can break internal dependencies.1 3
• This expands the budget Chainguard can sell into. Internal research places secure container images as roughly a $1B market, while hardened language packages are about $4.5B and the hardened VM layer about $3B. The VM launch therefore pushes Chainguard beyond cloud native teams into the much larger installed base of legacy enterprise ops.1 2
• Competition is converging from both sides. Docker launched Hardened Images in May 2025 and Wiz launched WizOS in public preview in September 2025, but both are container first. Chainguard VMs are aimed at the part of the estate those products do not fully solve, the server VMs that organizations still manage outside container platforms.2 4 5

The next step is for software supply chain security to become one control plane across containers, libraries, and VMs. If Chainguard keeps shipping patched VM images with the same compliance artifacts and SLA discipline, it can move from being a tool bought by platform engineers to a standard security layer for any Linux workload an enterprise still runs.1 2 3