tutorial

Monitoring Chainguard Images with Vigilmon: Registry Health, SSL Alerts & Supply Chain Uptime

How to monitor Chainguard Images with Vigilmon — registry pull availability, SSL certificate monitoring, image manifest checks, and supply chain uptime alerting.

Chainguard Images are minimal, hardened container base images built on Wolfi — offering near-zero CVEs and distroless-style builds for Node.js, Python, Go, Java, and dozens of other runtimes. Production pipelines that pull from cgr.dev during CI builds or Kubernetes deployments depend on Chainguard's registry being reachable and their signed manifests being verifiable. When cgr.dev is unreachable, CI pipelines stall at image pull, new Kubernetes pods fail to start, and security-hardened base images can't be refreshed. Vigilmon gives you external visibility into Chainguard's registry availability, SSL certificate health, and the specific image tags your pipeline depends on.

What You'll Build

  • A monitor on the Chainguard registry to detect pull failures before CI does
  • SSL certificate monitoring for cgr.dev
  • Image manifest availability checks for your critical base images
  • An alerting setup that distinguishes registry-wide outages from per-image tag issues

Prerequisites

  • Docker or crane CLI installed for testing pulls
  • Knowledge of which Chainguard Images you use (e.g., cgr.dev/chainguard/node, cgr.dev/chainguard/python)
  • A free account at vigilmon.online

Step 1: Verify Chainguard Registry Availability

The Chainguard registry at cgr.dev implements the OCI Distribution Specification. The v2 API ping endpoint confirms the registry is reachable:

curl -I https://cgr.dev/v2/

An operational registry returns 401 Unauthorized — this is the correct signal. It means the registry is up and enforcing authentication. A connection error, 502, or 503 means the registry is degraded.

Why 401? Unauthenticated requests to OCI-compliant registries return 401 with a WWW-Authenticate header listing auth endpoints. This is by design — a 401 proves the registry is answering, not that access is broken.

Step 2: Create a Vigilmon HTTP Monitor for the Registry

  1. Log in to Vigilmon → Add Monitor → HTTP.
  2. URL: https://cgr.dev/v2/.
  3. Check interval: 60 seconds.
  4. Response timeout: 15 seconds.
  5. Expected status: 401.
  6. Label: Chainguard registry v2 API.
  7. Click Save.

This monitor catches:

  • Full cgr.dev outages that would block every image pull in every pipeline
  • CDN or DNS disruptions affecting Chainguard's registry domain
  • Networking regressions after changes to your egress firewall or proxy rules
  • Chainguard infrastructure incidents before they appear on a status page

Alert sensitivity: Set to trigger after 1 consecutive failure. A registry pull failure in CI means every job that pulls a Chainguard base image will fail immediately.

Step 3: Monitor a Specific Image Manifest

Chainguard provides public (unauthenticated) access to catalog images like cgr.dev/chainguard/static. For images your pipeline uses, you can verify the tag manifest is reachable:

# Check manifest for the latest static image (no auth required for public images)
curl -I https://cgr.dev/v2/chainguard/static/manifests/latest

A reachable manifest returns 200 or 401. Add a Vigilmon monitor for each critical base image:

  1. Add Monitor → HTTP.
  2. URL: https://cgr.dev/v2/chainguard/static/manifests/latest.
  3. Check interval: 5 minutes.
  4. Expected status: 200.
  5. Label: Chainguard static image manifest.
  6. Click Save.

Repeat for other public catalog images you depend on, substituting the image name:

| Image | Manifest URL | |---|---| | cgr.dev/chainguard/node | https://cgr.dev/v2/chainguard/node/manifests/latest | | cgr.dev/chainguard/python | https://cgr.dev/v2/chainguard/python/manifests/latest | | cgr.dev/chainguard/go | https://cgr.dev/v2/chainguard/go/manifests/latest | | cgr.dev/chainguard/jre | https://cgr.dev/v2/chainguard/jre/manifests/latest |

For private Chainguard Images that require a pull token, these manifest endpoints will return 401. In that case, monitor the registry v2 ping from Step 2 and rely on your CI pipeline for tag-level health.

Step 4: Monitor Chainguard's SSL Certificate

Chainguard's TLS certificate on cgr.dev is critical for every docker pull. Docker and container runtimes validate TLS strictly — an expired or revoked certificate causes every image pull to fail with a TLS error, even if the registry is otherwise healthy.

  1. Add Monitor → SSL Certificate.
  2. Domain: cgr.dev.
  3. Alert when expiry is within: 30 days.
  4. Alert again: 14 days, 7 days, 3 days, 1 day.
  5. Click Save.

Chainguard uses automated certificate management, so expiry is rare — but monitoring it costs nothing and catches edge cases like certificate authority incidents or DNS misconfiguration that can present as certificate errors.

Step 5: Monitor the Chainguard Web Console

If your team uses the Chainguard console at console.enforce.dev for managing pull tokens, RBAC, or reviewing image provenance, monitoring its availability catches auth disruptions before developers report login failures:

  1. Add Monitor → HTTP.
  2. URL: https://console.enforce.dev.
  3. Check interval: 5 minutes.
  4. Response timeout: 15 seconds.
  5. Expected status: 200.
  6. Keyword: Chainguard.
  7. Label: Chainguard console.
  8. Click Save.

Step 6: Configure Alerting

In Vigilmon under Settings → Notifications, wire up your notification channels:

| Monitor | Trigger | Action | |---|---|---| | Registry v2 ping | Non-401 or connection error | Check Chainguard status page; alert pipeline teams | | Image manifest | Non-200 | Specific image tag missing or registry partially degraded | | SSL certificate | < 30 days to expiry | Open Chainguard support ticket; plan for CDN-level cert check | | Console | Non-200 or keyword missing | Auth flows affected; developers can't manage pull tokens |

Alert after: 1 consecutive failure for the registry monitor. 2 consecutive failures for manifest and console monitors (transient DNS glitches can cause single-check noise).

Common Chainguard Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | cgr.dev registry outage | v2 ping monitor unreachable; fires within 60 s | | CDN disruption on Chainguard's edge | v2 ping returns 502/503 instead of 401 | | SSL certificate issue on cgr.dev | SSL monitor alerts at 30-day threshold | | Specific image tag deleted or renamed | Manifest monitor for that image fires | | Console auth service down | Console monitor fires; registry pulls unaffected | | DNS misconfiguration for cgr.dev | All monitors fire simultaneously | | Chainguard pulls rate-limited | v2 ping still returns 401; CI failures appear without monitor alert | | Egress firewall blocks cgr.dev | All monitors fire (Vigilmon checks from external network) |

Chainguard Images reduce your container CVE surface dramatically, but that security posture depends on your pipeline being able to pull updated base images reliably. Vigilmon gives you external visibility into cgr.dev availability, SSL health, and individual image manifest reachability — so you know about registry disruptions before your CI pipeline or on-call rotation does.

Start monitoring Chainguard in under 5 minutes — register free at vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles