Chainctl on

Overview of Roles and Role-bindings in Chainguard

Wed, 03 Apr 2024 08:48:45 +0000

In the context of Chainguard, an identity represents an individual user within an organization. Chainguard’s IAM model allows administrators to assign identities to specialized roles which define the level of access that an identity has to the organization’s resources. You assign a role by creating a role-binding, which is what ties an identity to a given role.

This guide serves as an overview of what roles and role-bindings are within the context of Chainguard. It also outlines how you can manage roles and role-bindings with chainctl.

How to Install chainctl

Thu, 22 Sep 2022 15:56:52 -0700

Chainguard’s chainctl command-line interface provides essential tools for managing your container security infrastructure, including image management, identity and access control, and resource monitoring. This CLI enables automation of Chainguard operations and integration with CI/CD pipelines.

The tool uses the familiar <context> <noun> <verb> style of CLI interactions. For example, to retrieve a list of all the private Chainguard Containers available to your organization, you can run chainctl images list.

Before we begin, let’s move into a temporary directory that we can work in. Be sure you have curl installed, which you can achieve through visiting the curl download docs for your relevant operating system.

Compare chainctl usage with the Chainguard Console

Mon, 02 Jun 2025 11:07:52 +0200

Chainguard provides two powerful interfaces for managing container security resources: the web-based Console for visual exploration and the chainctl CLI for automation and scripting. Understanding when to use each tool maximizes your efficiency in managing Chainguard’s security-hardened containers and access controls.

Prerequisites

To access the Chainguard Console you need to create an account and sign in. The Console is accessible to everyone, including users who aren’t Chainguard customers.

Get Started with chainctl

Mon, 03 Mar 2025 08:49:15 +0000

Chainguard’s chainctl provides command-line access to manage container images, identity resources, and security configurations across your organization. This guide covers essential commands to begin using chainctl effectively in your security and DevOps workflows. For comprehensive command documentation, refer to the chainctl Reference.

Authenticate and Check Auth Status

To use chainctl, the first thing you must do is authenticate with the Chainguard platform. Do so with:

Manage Your chainctl configuration

Fri, 07 Jul 2023 05:56:52 -0700

Chainguard’s chainctl keeps a local configuration file that controls how the CLI behaves: which Chainguard environment it talks to, how it logs you in, the defaults it applies when you omit an argument, and how it formats output. This page explains the commands that manage that file, where it lives, and every setting you can configure.

chainctl config commands

chainctl config groups the commands that read and write the local configuration file. To list them, run:

chainctl Reference

Tue, 20 Sep 2022 08:49:15 +0000

The CLI tool chainctl helps you interact with the account model that Chainguard provides. The tool uses the familiar <context> <noun> <verb> style of CLI interactions. The current chainctl reference is below.

To install chainctl, follow our installation guide. Additionally, you may find these resources on working with chainctl to be of interest:

Find and Update Your chainctl Release Version

Thu, 06 Mar 2025 08:49:15 +0000

Chainguard regularly releases updates to chainctl with new security features, performance improvements, and expanded capabilities for container management. This guide explains how to check your current version and update to the latest release.

For a full reference of all commands with details and switches, refer to chainctl Reference.

View your chainctl version

To see which chainctl version you have installed, use:

chainctl Usage

Mon, 03 Mar 2025 08:49:15 +0000

Chainguard’s chainctl (Chainguard Control) is a command-line interface that provides comprehensive control over your Chainguard resources, including container images, identity management, and security configurations. This CLI tool enables automation and advanced operations beyond what’s available in the Chainguard Console, making it essential for DevOps workflows and CI/CD integration.

Like most control commands that end with ctl, such as systemctl or loginctl, chainctl uses the familiar <context> <noun> <verb> syntax.

This page lists a curated set of chainctl resources to help you get started.

Create, View, and Delete chainctl Events

Tue, 06 May 2025 08:49:15 +0000

Chainguard’s chainctl events commands provide programmatic access to security event streams using the CloudEvents specification. These commands enable you to monitor container activities, security alerts, and supply chain events across your organization for enhanced observability and compliance.

Chainguard Academy has several deeper guides on Chainguard CloudEvents. You may find our guide on Subscribing to Chainguard CloudEvents to be particularly useful for understanding how to work with events from Chainguard while Chainguard Events provides a deeper dive into the content and make up of events.

Manage Identity and Access with chainctl

Thu, 06 Mar 2025 08:49:15 +0000

Chainguard’s identity and access management (IAM) system provides fine-grained control over container registries, security resources, and organizational permissions. The chainctl iam commands enable you to manage users, roles, identities, and access policies programmatically for enhanced security and compliance.

For the following, assume that returned information only includes that which your account has permissions to view. Also, actions such as create and delete are similarly limited.

This page is intended as an introductory overview of IAM with chainctl. For a full reference of all commands with details and switches, refer to chainctl Reference.

Manage Chainguard Container Images with chainctl

Thu, 06 Mar 2025 08:49:15 +0000

Chainguard’s chainctl images commands provide comprehensive tools for managing security-hardened container images in your organization’s registry. These commands enable you to discover available images, analyze version histories, examine security metadata, and compare different image versions to make informed deployment decisions.

For a full reference of all commands with details and switches, refer to chainctl Reference.

List Available Chainguard Container Images

When you want to know which Chainguard Containers are available to your account, use the following command:

Automating with chainctl

Wed, 08 Jul 2026 00:00:00 +0000

chainctl works well at the command line for interactive use, but it is equally suited to automation. Most chainctl commands accept an --output=json flag, which lets you pipe their output to jq and build reliable scripting patterns around the results.

This page collects practical snippets you can adapt for shell scripts, scheduled jobs, and CI/CD pipelines. Each snippet is a self-contained building block; combine them to fit your workflow.

Note: The jq field names used in these examples reflect the expected JSON output structure. Run chainctl <command> --output=json | jq '.' to inspect the exact structure for your version of chainctl.

chainctl

Thu, 06 Aug 2026 11:47:15 +0000

chainctl

Chainguard Control

chainctl actions

Thu, 06 Aug 2026 11:47:15 +0000

chainctl actions

Interact with the Chainguard Actions product.

chainctl actions catalog

Thu, 06 Aug 2026 11:47:15 +0000

chainctl actions catalog

Browse the public Chainguard Actions catalog.

chainctl actions catalog list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl actions catalog list

List Chainguard Actions in the public catalog.

chainctl actions discover

Thu, 06 Aug 2026 11:47:15 +0000

chainctl actions discover

Discover GitHub Actions dependencies used by your workflows.

chainctl actions entitlements

Thu, 06 Aug 2026 11:47:15 +0000

chainctl actions entitlements

Manage Actions product entitlements.

chainctl actions entitlements create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl actions entitlements create

Enable the Actions product for an organization.

chainctl actions entitlements delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl actions entitlements delete

Disable the Actions product for an organization.

chainctl actions entitlements list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl actions entitlements list

List Actions product entitlements for an organization.

chainctl actions list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl actions list

List Chainguard Actions catalog entries for an organization.

chainctl agent

Thu, 06 Aug 2026 11:47:15 +0000

chainctl agent

Agent-powered commands.

chainctl agent accept-terms

Thu, 06 Aug 2026 11:47:15 +0000

chainctl agent accept-terms

Accept required legal terms.

chainctl auth

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth

Auth related commands for the Chainguard platform.

chainctl auth configure-docker

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth configure-docker

Configure a Docker credential helper

chainctl auth configure-npm

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth configure-npm

Configure npm credentials for Chainguard Libraries for JavaScript

chainctl auth delete-account

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth delete-account

Permanently delete your user account.

chainctl auth login

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth logout

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth logout

Logout from the Chainguard platform.

chainctl auth pull-token

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth pull-token

Create a pull token.

chainctl auth pull-token create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth pull-token create

Create a pull token.

chainctl auth pull-token list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth pull-token list

List all pull-tokens

chainctl auth status

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth status

Inspect the local Chainguard Token.

chainctl auth token

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth token

Print the local Chainguard Token.

chainctl auth token capabilities

Thu, 06 Aug 2026 11:47:15 +0000

chainctl auth token capabilities

Print the capabilities of the local Chainguard Token.

chainctl config

Thu, 06 Aug 2026 11:47:15 +0000

chainctl config

Local config file commands for chainctl.

chainctl config edit

Thu, 06 Aug 2026 11:47:15 +0000

chainctl config edit

Edit the current chainctl config file.

chainctl config reset

Thu, 06 Aug 2026 11:47:15 +0000

chainctl config reset

Remove local chainctl config files and restore defaults.

chainctl config save

Thu, 06 Aug 2026 11:47:15 +0000

chainctl config save

Save the current chainctl config to a config file.

chainctl config set

Thu, 06 Aug 2026 11:47:15 +0000

chainctl config set

Set an individual configuration value property.

chainctl config unset

Thu, 06 Aug 2026 11:47:15 +0000

chainctl config unset

Unset a configuration property and return it to default.

chainctl config validate

Thu, 06 Aug 2026 11:47:15 +0000

chainctl config validate

Run diagnostics on local config.

chainctl config view

Thu, 06 Aug 2026 11:47:15 +0000

chainctl config view

View the current chainctl config.

chainctl events

Thu, 06 Aug 2026 11:47:15 +0000

chainctl events

Events related commands for the Chainguard platform.

chainctl events subscriptions

Thu, 06 Aug 2026 11:47:15 +0000

chainctl events subscriptions

Subscription interactions.

chainctl events subscriptions create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl events subscriptions create

Subscribe to events under an organization or folder.

chainctl events subscriptions delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl events subscriptions delete

Delete a subscription.

chainctl events subscriptions list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl events subscriptions list

List subscriptions.

chainctl guardener

Thu, 06 Aug 2026 11:47:15 +0000

chainctl guardener

Manage guardener integrations.

chainctl guardener github

Thu, 06 Aug 2026 11:47:15 +0000

chainctl guardener github

Link and unlink a GitHub organization to a Chainguard group.

chainctl guardener github link

Thu, 06 Aug 2026 11:47:15 +0000

chainctl guardener github link

Link a GitHub organization to a Chainguard group.

chainctl guardener github migrate

Thu, 06 Aug 2026 11:47:15 +0000

chainctl guardener github migrate

Migrate a repository’s GitHub Actions to their Chainguard equivalents.

chainctl guardener github migrate create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl guardener github migrate create

Enqueue a GitHub Actions migration for a repository.

chainctl guardener github migrate get

Thu, 06 Aug 2026 11:47:15 +0000

chainctl guardener github migrate get

Show the state of a migration operation.

chainctl guardener github status

Thu, 06 Aug 2026 11:47:15 +0000

chainctl guardener github status

List the GitHub organizations linked to a Chainguard group.

chainctl guardener github unlink

Thu, 06 Aug 2026 11:47:15 +0000

chainctl guardener github unlink

Unlink a GitHub organization from its Chainguard group.

chainctl iam

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam

IAM related commands for the Chainguard platform.

chainctl iam account-associations

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations

Configure and manage cloud provider account associations.

chainctl iam account-associations check

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations check

Check the OIDC federation configurations for cloud providers.

chainctl iam account-associations check aws

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations check aws

Checks that the given location has been properly configured for OIDC federation with AWS

chainctl iam account-associations check azure

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations check azure

Checks that the given location has been properly configured for OIDC federation with AZURE

chainctl iam account-associations check gcp

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations check gcp

Checks that the given location has been properly configured for OIDC federation with GCP

chainctl iam account-associations describe

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations describe

Describe cloud provider account associations for a location.

chainctl iam account-associations set

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations set

Set cloud provider account associations for a location.

chainctl iam account-associations set aws

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations set aws

Set AWS account association for a location.

chainctl iam account-associations set azure

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations set azure

Set AZURE account association for a location.

chainctl iam account-associations set gcp

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations set gcp

Set GCP account association for a location.

chainctl iam account-associations unset

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations unset

Remove cloud provider account associations from a location.

chainctl iam account-associations unset aws

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations unset aws

Remove AWS account configuration for a location.

chainctl iam account-associations unset azure

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations unset azure

Remove AZURE account configuration for a location.

chainctl iam account-associations unset gcp

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam account-associations unset gcp

Remove GCP account configuration for a location.

chainctl iam external-group-role-mappings

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam external-group-role-mappings

Manage IdP group-to-role mappings (also available under ‘iam identity-providers group-mappings’).

chainctl iam external-group-role-mappings create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam external-group-role-mappings create

Create an IdP group-to-role mapping.

chainctl iam external-group-role-mappings delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam external-group-role-mappings delete

Delete IdP group-to-role mappings.

chainctl iam external-group-role-mappings list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam external-group-role-mappings list

List IdP group-to-role mappings.

chainctl iam folders

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam folders

IAM folders interactions.

chainctl iam folders delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam folders delete

Delete a folder.

chainctl iam folders describe

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam folders describe

Describe a folder.

chainctl iam folders list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam folders list

List folders under an organization.

chainctl iam folders update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam folders update

Update a folder.

chainctl iam identities

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities

Identity management.

chainctl iam identities create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities create

Create a new identity.

chainctl iam identities create aws

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities create aws

Create a new identity for an AWS IAM resource.

chainctl iam identities create aws role

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities create aws role

chainctl iam identities create aws role NAME --aws-account-id=ACCOUNT --aws-role-name=NAME [--aws-role-id=ID] [--aws-partition=PARTITION] [--parent=PARENT] [--description=DESC] [--role=ROLE,ROLE,...] [--output=id|json|table]

Examples

 # Create an assumable identity for an AWS IAM role.
chainctl iam identities create aws role my-aws-identity --aws-account-id=123456789012 --aws-role-name=my-role
# Create an assumable identity for an AWS IAM role. Bind it to the registry.pull role.
chainctl iam identities create aws role my-aws-identity --aws-account-id=123456789012 --aws-role-name=my-role --role=registry.pull
# Provide the unique ID of an AWS IAM role. This prevents the identity from being assumed if the role is deleted and then recreated with the same name.
chainctl iam identities create aws role my-aws-identity --aws-account-id=123456789012 --aws-role-name=my-role --aws-role-id=AROAEXAMPLEC2UL7LUB
# Create an assumable identity for an AWS IAM role in the aws-us-gov partition.
chainctl iam identities create aws role my-aws-identity --aws-partition=aws-us-gov --aws-account-id=123456789012 --aws-role-name=my-role

Options

 --aws-account-id string The ID of the AWS account.
--aws-partition string The partition in which the role is located. For instance: aws, aws-cn or aws-us-gov. (default "aws")
--aws-role-id string The unique ID of the IAM role.
--aws-role-name string The name of the IAM role.
-d, --description string The description of the resource.
-n, --name string Given name of the resource.
--parent string The name or id of the parent location to create this identity under.
--role strings A comma separated list of names or IDs of roles to bind this identity to (optional).
-y, --yes Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively.

Options inherited from parent commands

 --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.

chainctl iam identities create aws user

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities create aws user

chainctl iam identities create aws user NAME --aws-account-id=ACCOUNT --aws-user-name=NAME [--aws-user-id=ID] [--aws-partition=PARTITION] [--parent=PARENT] [--description=DESC] [--role=ROLE,ROLE,...] [--output=id|json|table]

Examples

 # Create an assumable identity for an IAM user
chainctl iam identities create aws user my-aws-identity --aws-account-id=123456789012 --aws-user-name=my-user
# Create an assumable identity for an IAM user. Bind it to the registry.pull role.
chainctl iam identities create aws user my-aws-identity --aws-account-id=123456789012 --aws-user-name=my-user --role=registry.pull
# Provide the unique ID of the user. This prevents the identity from being assumed if the user is deleted and then recreated with the same name.
chainctl iam identities create aws user my-aws-identity --aws-account-id=123456789012 --aws-user-name=my-user --aws-user-id=AIDAEXAMPLEC2UL7LUB
# Create an assumable identity for a user in the aws-us-gov partition
chainctl iam identities create aws user my-aws-identity --aws-partition=aws-us-gov --aws-account-id=123456789012 --aws-user-name=my-user

Options

 --aws-account-id string The ID of the AWS account.
--aws-partition string The partition in which the user is located. For instance: aws, aws-cn or aws-us-gov. (default "aws")
--aws-user-id string The unique ID of the IAM user.
--aws-user-name string The name of the IAM user.
-d, --description string The description of the resource.
-n, --name string Given name of the resource.
--parent string The name or id of the parent location to create this identity under.
--role strings A comma separated list of names or IDs of roles to bind this identity to (optional).
-y, --yes Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively.

Options inherited from parent commands

 --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.

chainctl iam identities create github

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities create github

chainctl iam identities create github NAME --github-repo=REPO [--github-ref=REF] [--github-audience=AUD] [--parent=PARENT] [--description=DESC] [--role=ROLE,ROLE,...] [--output=id|json|table]

Examples

 # Create a GitHub Actions identity for any branch in a repo
chainctl iam identities create github my-gha-identity --github-repo=my-org/repo-name --parent=eng-org
# Create a GitHub Actions identity for a given branch in a repo and bind to a role
chainctl iam identities create github my-gha-identity --github-repo=my-org/repo-name --github-ref=refs/heads/test-branch --role=owner

Options

 -d, --description string The description of the resource.
--github-audience string The audience for the GitHub OIDC token
--github-ref string The branch reference for the executing action (optional).
--github-repo string The name of a GitHub repo where the action executes.
-n, --name string Given name of the resource.
--parent string The name or id of the parent location to create this identity under.
--role strings A comma separated list of names or IDs of roles to bind this identity to (optional).
-y, --yes Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively.

Options inherited from parent commands

 --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.

chainctl iam identities create gitlab

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities create gitlab

chainctl iam identities create gitlab NAME --project-path=GITLAB-GROUP/GITLAB-PROJECT --ref-type={tag|branch} [--ref=REF] [--parent=PARENT] [--description=DESC] [--role=ROLE,ROLE,...] [--output=id|json|table]

Examples

 # Create a Gitlab CI identity for any branch in a given Gitlab project
chainctl iam identities create gitlab my-gitlab-identity --project-path=my-group/my-project --ref-type=branch --parent=eng-org
# Create a Gitlab CI identity for a given branch in a Gitlab project and bind to a role
chainctl iam identities create gitlab my-gitlab-identity --project-path=my-group/my-project --ref-type=branch --ref=main --role=owner

Options

 -d, --description string The description of the resource.
-n, --name string Given name of the resource.
--parent string The name or id of the parent location to create this identity under.
--project-path string The name of a Gitlab project where the action executes in the form "group-name/project-name[/foo/bar]". You can use a "*" for project-name (or sub-projects) to match any project in the group.
--ref string The reference for the executing action. If left empty or "*", all references will match.
--ref-type string The type of reference for the executing action, must be either "tag" or "branch".
--role strings A comma separated list of names or IDs of roles to bind this identity to (optional).
-y, --yes Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively.

Options inherited from parent commands

 --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.

chainctl iam identities delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities delete

Delete one or more identities.

chainctl iam identities describe

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities describe

View the details of an identity.

chainctl iam identities list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities list

List identities.

chainctl iam identities update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identities update

Update an identity

chainctl iam identity-providers

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers

customer managed identity provider management

chainctl iam identity-providers create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers create

Create an identity provider

chainctl iam identity-providers delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers delete

Delete an identity provider.

chainctl iam identity-providers group-mappings

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers group-mappings

Manage IdP group-to-role mappings for an identity provider.

chainctl iam identity-providers group-mappings create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers group-mappings create

Create an IdP group-to-role mapping.

chainctl iam identity-providers group-mappings delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers group-mappings delete

Delete an identity provider’s group-to-role mappings.

chainctl iam identity-providers group-mappings list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers group-mappings list

List an identity provider’s group-to-role mappings.

chainctl iam identity-providers list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers list

List identity providers.

chainctl iam identity-providers scim

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers scim

Manage SCIM provisioning for an identity provider.

chainctl iam identity-providers scim disable

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers scim disable

Disable SCIM provisioning for an identity provider.

chainctl iam identity-providers scim enable

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers scim enable

Enable SCIM provisioning for an identity provider.

chainctl iam identity-providers scim token

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers scim token

Manage the SCIM provisioning bearer token for an identity provider.

chainctl iam identity-providers scim token generate

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers scim token generate

Generate the first SCIM bearer token for an identity provider.

chainctl iam identity-providers scim token regenerate

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers scim token regenerate

Regenerate the SCIM bearer token for an identity provider.

chainctl iam identity-providers scim token revoke

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers scim token revoke

Revoke the SCIM bearer token for an identity provider.

chainctl iam identity-providers update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam identity-providers update

Update an identity provider

chainctl iam invites

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam invites

Manage invite codes that register identities with Chainguard.

chainctl iam invites create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam invites create

Generate an invite code to identities with Chainguard.

chainctl iam invites delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam invites delete

Delete invite codes

chainctl iam invites list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam invites list

List organization and folder invites.

chainctl iam organizations

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam organizations

IAM organization interactions.

chainctl iam organizations delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam organizations delete

Delete an organization.

chainctl iam organizations describe

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam organizations describe

Describe an organization.

chainctl iam organizations list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam organizations list

List organizations.

chainctl iam role-bindings

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam role-bindings

IAM role-bindings resource interactions.

chainctl iam role-bindings create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam role-bindings create

Create a role-binding

chainctl iam role-bindings delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam role-bindings delete

Delete a role-binding.

chainctl iam role-bindings list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam role-bindings list

List role-bindings.

chainctl iam role-bindings update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam role-bindings update

Update a role-binding.

chainctl iam roles

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam roles

IAM role resource interactions.

chainctl iam roles capabilities

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam roles capabilities

IAM role capabilities

chainctl iam roles capabilities list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam roles capabilities list

List IAM role capabilities.

chainctl iam roles create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam roles create

Create an IAM role.

chainctl iam roles delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam roles delete

Delete a custom IAM role.

chainctl iam roles list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam roles list

List IAM roles.

chainctl iam roles update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl iam roles update

Update an IAM role.

chainctl images

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images

Images related commands for the Chainguard platform.

chainctl images advisories

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images advisories

Security advisory commands for images.

chainctl images advisories list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images advisories list

List security advisories for packages in an image.

chainctl images changelog

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images changelog

Show changelog for image history

chainctl images diff

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images diff

Diff images.

chainctl images entitlements

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images entitlements

Manage entitlements to registry repositories.

chainctl images entitlements list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images entitlements list

List registry entitlements of an organization.

chainctl images helm

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images helm

Helm chart related commands

chainctl images helm refs

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images helm refs

List image references pinned in a Chainguard Helm chart

chainctl images helm values

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images helm values

Generate relocation overrides for a Chainguard Helm chart

chainctl images history

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images history

Show history for a specific image tag.

chainctl images list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images list

List tagged images from Chainguard registries.

chainctl images repos

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos

Image repo related commands for the Chainguard platform.

chainctl images repos build

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos build

Manage custom image builds

chainctl images repos build apply

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos build apply

Apply a build config

chainctl images repos build edit

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos build edit

Edit a build config, optionally creating a new repo with –save-as

chainctl images repos build list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos build list

List build reports

chainctl images repos build logs

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos build logs

Get build logs

chainctl images repos create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos create

Create an image repository.

chainctl images repos delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos delete

Remove an image repository.

chainctl images repos list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos list

List image repositories.

chainctl images repos update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images repos update

Update image repositories.

chainctl images tags

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images tags

Tags related commands for images.

chainctl images tags list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images tags list

List tags from repositories using –parent, –public, or –repo flags.

chainctl images tags resolve

Thu, 06 Aug 2026 11:47:15 +0000

chainctl images tags resolve

Resolve tags for a specific image reference.

chainctl libraries

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries

Ecosystem library related commands.

chainctl libraries cache

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries cache

Manage the Libraries resolution cache.

chainctl libraries cache list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries cache list

List resolution cache entries.

chainctl libraries cache opt-in

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries cache opt-in

Opt the org back into the resolution cache.

chainctl libraries cache opt-out

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries cache opt-out

Opt the org out of the resolution cache.

chainctl libraries cache status

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries cache status

Show resolution cache status.

chainctl libraries cache zap

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries cache zap

Zap resolution cache entries.

chainctl libraries entitlements

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries entitlements

Manage entitlements to language ecosystem libraries.

chainctl libraries entitlements create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries entitlements create

Create ecosystem library entitlements for an organization.

chainctl libraries entitlements delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries entitlements delete

Delete an ecosystem library entitlement from an organization.

chainctl libraries entitlements list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries entitlements list

List entitlements of an organization.

chainctl libraries packages

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries packages

Inspect Libraries packages.

chainctl libraries packages blocked

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries packages blocked

List blocked Libraries packages.

chainctl libraries packages count

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries packages count

Count Libraries packages per ecosystem.

chainctl libraries packages list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries packages list

List Libraries packages.

chainctl libraries packages malware

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries packages malware

Inspect the Chainguard malware/greyware blocklist.

chainctl libraries packages malware list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries packages malware list

List the Chainguard malware/greyware blocklist.

chainctl libraries packages versions

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries packages versions

List the versions of a Libraries package.

chainctl libraries policy

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy

Manage Libraries policies.

chainctl libraries policy binding

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy binding

Manage Libraries policy bindings.

chainctl libraries policy binding create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy binding create

Create a Libraries policy binding.

chainctl libraries policy binding delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy binding delete

Delete a Libraries policy binding.

chainctl libraries policy binding list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy binding list

List Libraries policy bindings.

chainctl libraries policy binding update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy binding update

Update a Libraries policy binding.

chainctl libraries policy create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy create

Create a custom Libraries policy.

chainctl libraries policy delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy delete

Delete a custom Libraries policy.

chainctl libraries policy describe

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy describe

Describe a Libraries policy.

chainctl libraries policy disable

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy disable

Disable a Libraries policy for an organization.

chainctl libraries policy enable

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy enable

Enable a Libraries policy for an organization.

chainctl libraries policy list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy list

List Libraries policies.

chainctl libraries policy update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries policy update

Update a custom Libraries policy.

chainctl libraries update-hashes

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries update-hashes

Update lockfile integrity hashes with Chainguard Libraries checksums

chainctl libraries verify

Thu, 06 Aug 2026 11:47:15 +0000

chainctl libraries verify

A tool to analyze the use of Chainguard Libraries in various artifacts

chainctl packages

Thu, 06 Aug 2026 11:47:15 +0000

chainctl packages

Interact with Chainguard packages

chainctl packages versions

Thu, 06 Aug 2026 11:47:15 +0000

chainctl packages versions

Package version related commands for the Chainguard platform.

chainctl packages versions list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl packages versions list

List version stream data for a managed package.

chainctl policies

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies

Manage policies.

chainctl policies binding

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies binding

Manage policy bindings.

chainctl policies binding create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies binding create

Create a policy binding.

chainctl policies binding delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies binding delete

Delete a policy binding.

chainctl policies binding list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies binding list

List policy bindings.

chainctl policies check

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies check

Check an image against active policies.

chainctl policies custom

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies custom

Manage your custom policies.

chainctl policies custom create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies custom create

Create a custom policy.

chainctl policies custom delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies custom delete

Delete a custom policy.

chainctl policies custom update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies custom update

Update a custom policy.

chainctl policies custom validate

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies custom validate

Validate a custom policy manifest or expression without persisting it.

chainctl policies decision

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies decision

Inspect policy decisions.

chainctl policies decision list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies decision list

List policy decisions.

chainctl policies describe

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies describe

Describe a policy and its parameter schema.

chainctl policies disable

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies disable

Disable a policy.

chainctl policies enable

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies enable

Enable a policy for an organization.

chainctl policies list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies list

List policies.

chainctl policies override

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies override

Manage policy overrides.

chainctl policies override create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies override create

Create a policy override.

chainctl policies override delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies override delete

Delete a policy override.

chainctl policies override list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl policies override list

List policy overrides.

chainctl skills

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills

Skills registry related commands.

chainctl skills accept-terms

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills accept-terms

Accept legal terms required to publish skills.

chainctl skills delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills delete

Remove a published version of a skill.

chainctl skills describe

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills describe

Show metadata for a published skill.

chainctl skills entitlements

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills entitlements

Manage skills entitlements for an organization.

chainctl skills entitlements create

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills entitlements create

Create a skills entitlement for an organization.

chainctl skills entitlements delete

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills entitlements delete

Delete the skills entitlement from an organization.

chainctl skills entitlements list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills entitlements list

List skills entitlements of an organization.

chainctl skills install

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills install

Download a skill and install it into agent directories.

chainctl skills list

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills list

List skills published by an org.

chainctl skills pull

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills pull

Download a published skill to a local directory.

chainctl skills push

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills push

Package a skill directory and publish it to uploads.cgr.dev.

chainctl skills uninstall

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills uninstall

Remove a skill from agent directories on the local machine.

chainctl skills validate

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills validate

Check a skill directory for spec compliance without making network calls.

chainctl skills versions

Thu, 06 Aug 2026 11:47:15 +0000

chainctl skills versions

List all published versions (tags) for a skill.

chainctl starter

Thu, 06 Aug 2026 11:47:15 +0000

chainctl starter

Manage catalog starter organizations

chainctl starter add-images

Thu, 06 Aug 2026 11:47:15 +0000

chainctl starter add-images

Add catalog images to your catalog starter organization.

chainctl starter init

Thu, 06 Aug 2026 11:47:15 +0000

chainctl starter init

Initialize a new catalog starter organization.

chainctl starter request-access

Thu, 06 Aug 2026 11:47:15 +0000

chainctl starter request-access

Request access to a catalog starter organization.

chainctl starter status

Thu, 06 Aug 2026 11:47:15 +0000

chainctl starter status

Show catalog starter organization status, quota, and image readiness.

chainctl update

Thu, 06 Aug 2026 11:47:15 +0000

chainctl update

Update chainctl.

chainctl version

Thu, 06 Aug 2026 11:47:15 +0000

chainctl version

Prints the version