Chainguard catalog driven economics

This is a software gross margin story disguised as a security product. Chainguard builds an image once, then sells the same hardened artifact across many customers through catalog access, so onboarding usually means granting entitlements and pull credentials, not spinning up a new services project. The catalog model is explicit in pricing, which offers full access to 3,000 plus images with unlimited pulls and no metering, while the registry and Wolfi build pipeline stay shared infrastructure across tenants.1 2 3 4

• The product is delivered like a library, not a consulting engagement. Customers browse the directory, choose images, authenticate to cgr.dev, and pull into CI or Kubernetes with standard container tooling. That keeps delivery work close to zero after the image already exists.1 2 5
• Catalog access makes the economics better than per image licensing as customers expand usage. Once the fixed cost of building, signing, patching, and hosting an image is covered, additional customers mostly add authentication, support, and bandwidth, not fresh R&D for each deployment.2 3 4 5
• This also explains the competitive pressure from Docker and Wiz. If secure images become a standard layer bundled into larger platforms, the winner is likely the company with the broadest catalog, fastest patching loop, and lowest cost to serve each extra pull across a shared registry.5 6 7

The next step is turning the same shared supply chain into adjacent products. Chainguard is already extending from containers into libraries and virtual machines, which follows the same playbook, build a hardened artifact once, distribute it many times, and spread fixed platform costs across a larger security catalog.3 4 7