# Overview of Chainguard's package repositories URL: https://chainguard-docs-preview-git-athena-mention.chainguard.app/chainguard/containers/building-and-modifying/packages/package-model.md Last Modified: October 8, 2026 Tags: Chainguard Containers, Overview, Product Overview of Chainguard's package repositories, highlighting the different repositories and how to access them. Chainguard's container images are built using packages from the Wolfi and Chainguard OS Linux distributions. If you need to extend or customize an image, it can be useful to access these packages directly. Chainguard offers curated package repositories to support containerized workloads and simplify dependency management. These repositories ensure you can access trusted packages — whether building custom container images, working with Chainguard OS, or using Chainguard Containers in production. This article provides an overview of Chainguard's package model, highlighting the different Chainguard package repositories available to customers. ## Repository types All users have access to two distinct package repositories maintained by Chainguard: * Wolfi * Extra Additionally, Chainguard customers have access to a Private APK Repository specific to their organization. > **Note**: Be aware that SLAs apply to container images, not individual packages. Chainguard's container images are designed to run apk packages, a package format developed for [Alpine Linux](https://www.alpinelinux.org/). Accordingly, Chainguard's package repositories contain apk packages, and you can interact with them using the standard [`apk` commands](https://docs.alpinelinux.org/user-handbook/0.1a/Working/apk.html). Chainguard maintains the packages within all of these package repositories. The following table presents a high-level overview of these package repositories: | Repository Type | Access Level | Package Scope | Authentication Required | Typical Use Case | | ----------------- | :----------------: | :----------------------: | :-----------------------: | :------------------------: | | Wolfi | Public | Wolfi ecosystem | No | Free images | | Extra | Public | Supplemental utilities | No | Additional dependencies, non-open source software | | Private | Private/Organization-specific | Packages in org-entitled container images ¹ | Yes | Customizing Chainguard Containers with [Custom Assembly](/chainguard/containers/custom-assembly/overview/) | ¹ Customers using Chainguard OS Packages have access to far more packages than this to build their own images, but the additional packages are not available to use with Custom Assembly. Read the details in [Private APK repositories](#private-apk-repositories). ## Public repositories Chainguard has two public package repositories: the Wolfi and Extra Packages repositories. These repos typically include the latest stable versions and explicitly exclude FIPS-validated packages or version streams. ### Wolfi The [Wolfi packages repository](https://github.com/wolfi-dev/os) is the public package source for [Wolfi, Chainguard's open source Linux "undistro."](https://www.chainguard.dev/supply-chain-security-101/wolfi-overview) It contains all the open source packages used in Chainguard's Free container images. As a public repository, the Wolfi APK repo doesn't require authentication. By default, Chainguard's Free container images use a generic address for this repository (`https://apk.cgr.dev/chainguard`) in their `/etc/apk/repositories` files: ```shell docker run -it --rm --entrypoint cat cgr.dev/chainguard/python:latest-dev /etc/apk/repositories ``` ```output https://apk.cgr.dev/chainguard ``` Users that aren't Chainguard customers can use this URL to add packages from the Wolfi repository. Chainguard customers can access it with a URL that's unique to their organization: ```url https://virtualapk.cgr.dev/$ORGANIZATION_ID/chainguard ``` If you need packages outside Wolfi's open source scope, or under less permissive licenses, Chainguard offers a supplemental Packages repository ### Extra packages Chainguard's Extra Packages repository is a public-facing APK repository that includes utilities and compatibility packages that aren't fully open source, but can still be redistributed by Chainguard. The repository’s primary role is to provide supplemental packages needed to support containerized applications, especially when those utilities fall outside the scope of the official base images or are under less permissive licenses than those in the Wolfi repository. The Extra Packages repository follows similar rules to the Wolfi repo, but explicitly allows packages under more restrictive licenses as long as redistribution is permitted. The Extra Packages repository isn't specified in the `/etc/apk/repositories` file of Chainguard's Free images by default. However, users that aren't Chainguard customers can access it through the generic address `https://apk.cgr.dev/extra-packages`. Like the Wolfi repository, customers can access it with a URL that's unique to their organization: ```url https://virtualapk.cgr.dev/$ORGANIZATION_ID/extra-packages ``` ### Working with public repositories As mentioned previously, both the Wolfi and Extra Packages repositories are public and don't require authentication. Chainguard customers can access both with a URL that's unique to their organization: * Wolfi: `https://virtualapk.cgr.dev/$ORGANIZATION_ID/chainguard` * Extra: `https://virtualapk.cgr.dev/$ORGANIZATION_ID/extra-packages` You must replace `$ORGANIZATION_ID` with your organization's unique identifier (UID). You can find this with `chainctl` if [you've installed it](/platform/chainctl-usage/how-to-install-chainctl/): ```shell chainctl iam orgs ls -o table ``` You must replace `$ORGANIZATION_ID` with your organization's `ID` value, not its name: ```output ID | NAME | DESCRIPTION ------------------------------------------|-----------------|-------------------------------------- 0a************************************c8 | example.com | This is an example organization ``` You can also find this in the [Chainguard Console](https://console.chainguard.dev/). After logging in, open the **Settings** tab. There, you'll find your organization's identifier under **Organization UID**. Be aware that these repository URLs **will not** resolve properly if you include the name of your organization instead of the UID. For any of your organization's container images that include the APK package manager, these repositories are included by default. You can also add them to the `/etc/apk/repositories` file of any container that uses APK. Our guide on [How to pull packages from Chainguard package repositories through Artifactory](/chainguard/containers/registry/pull-through-guides/artifactory-packages-pull-through/#configuring-pull-through-caches-for-chainguards-public-repositories) includes directions for setting up pull-through caches for these repositories on Artifactory. ### Package retention in public repositories To limit the size of public APK repositories and maintain efficient `apk` operations, Chainguard periodically removes older package versions based on a package retention policy. The public Wolfi and Extra repositories currently retain non-latest package versions for **12 months**. Over time, this retention window may be reduced to **3 months**; any change will be announced in advance. Retention rules for public repositories: * Non-latest package versions older than 12 months are removed unless: * They are required by other Wolfi packages. * They are required by Chainguard Container images. * Additionally, Chainguard removes latest package versions if the corresponding package definition has been removed from the Wolfi source repository (`https://github.com/wolfi-dev/os`), unless they meet one of these exceptions. If you pin specific package versions, ensure those versions remain within the retention window or mirror them internally. Chainguard removes packages on a monthly basis, on the second Wednesday of each month. Candidates for removal are announced one month in advance. Public repositories affected: * Wolfi (`https://apk.cgr.dev/chainguard`) * Extra (`https://apk.cgr.dev/extra-packages`) ## Private APK repositories Chainguard customers have access to a private APK repository that is only accessible to members of their organization. An organization's private APK repository contains packages not included in either of the public repos, such as the main packages found in [Production containers](/chainguard/containers/concepts/container-categories/#production-containers), as well as any packages relating to FIPS support. That said, it's likely an organization's private APK repository also includes many of the same packages found in the Wolf or Extra Packages repositories. The list of packages available in a given organization’s private repository is based on the packages available in the Chainguard Containers that the organization already has access to. For example, say your organization has access to the Chainguard MySQL container image. Along with the container's main package (`mysql`), this image comes with other apk packages, including `bash`, `glibc`, and `pwgen`. This means that you’ll have access to these apk packages through your organization’s private APK repository, along with any that appear in other Chainguard container images that your organization has access to. Chainguard's private APK repositories have URLs that follow this form: ```url https://apk.cgr.dev/$ORGANIZATION_ID ``` Because Chainguard's private APK repos are only accessible to members of a specific organization, you must authenticate in order to access them. Refer to our overview of [Chainguard's private APK repositories](/chainguard/containers/building-and-modifying/packages/private-apk-repos/) for more information. Additionally, note that if you customize a Chainguard Container using the [Custom Assembly tool](/chainguard/containers/custom-assembly/overview/), the list of packages available for you to add to your container image is taken from your organization's private APK repository. There is one exception: Chainguard OS Packages is an offering for larger customers who already build their own images from packages using tools like Bazel, Dockerfiles, and rules\_apko and want to use a wider set of packages from Chainguard. This includes over 400,000 packages that will be made available in a private APK repository. You are responsible for the image builds, the build tooling, validation, and compatibility while Chainguard builds the packages in the Chainguard Factory with complete SBOMs and our standard enterprise-grade, zero-CVE process. This offering is limited to those who want to use Chainguard-sourced packages in their existing, mature image building processes. Chainguard OS Packages are not currently available for use with Chainguard Custom Assembly. However, they are made available to you in the same private APK repository location as is described in this page. The only difference is the number of packages that are available. So, any existing build automation you are using will continue to work. ### Package retention in private repositories Private APK repositories for Chainguard customers follow a **12-month** retention period for non-latest package versions. They follow the same retention rules and removal schedule as the public Wolfi repository. Customers that require older package versions should mirror or store copies internally. ## Package support Chainguard commits to build packages in the Chainguard Factory with complete SBOMs and our standard enterprise-grade, zero-CVE process. Packages that are used in Chainguard Container images are also covered by our [CVE remediation SLA](https://www.chainguard.dev/legal/cve-policy?utm_source=docs). That commitment continues to apply to these packages when they are included in private APK repositories, but not to images you build yourself using those packages. We cannot extend our SLA to the images because we do not have control of your build. Similar to the [Chainguard shared responsibility model](https://edu.chainguard.dev/chainguard/containers/concepts/shared-responsibility-model/) for container images, you are responsible for your authored image builds, the build tooling, validation, and compatibility, but now you can do all this using packages that are scanned daily for CVEs. We recommend you always update your builds to new package versions as we release them so are still benefiting from the SLA even if your custom-built images are not covered by it. ## Learn more Chainguard’s package repositories provide trusted apk packages to support both standard and advanced containerized workloads. With the public Wolfi and Extra repositories alongside organization-specific private repositories, customers can reliably source the dependencies they need for production environments. We encourage you to learn more about Chainguard's private APK repositories by referring to our [documentation on the subject](/chainguard/containers/building-and-modifying/packages/private-apk-repos/). If you're ready to add a package to one of your container images, [Adding a package to a Chainguard Container](/chainguard/containers/building-and-modifying/adding-packages/) compares the available approaches and walks through the task.