Vigilance vs Chainguard
Chainguard. Builds container images that hold almost nothing, so there is little in them to go wrong. Vigilance finds the update that gained a hidden power, before you install it.
The Catch Chainguard Cannot Make
Chainguard ships images with almost nothing inside. The few parts left still update, and an update can turn bad. Vigilance keeps no list. It compares the version you trust with the version you install. It reports any file that can suddenly do more.
A real one: axios, March 2026
axios is one of the most-installed packages on the internet. In release 1.14.1, its package.json gained a hidden install step. That step pulls down a remote-control program. A smaller image still ships this update. One command sees it:
vigi diff --old ./axios-1.14.0 --new ./axios-1.14.1
HEADS UP. 1 file changed. package.json can now run a hidden helper on install and reach the network.
Run both. Chainguard shrinks what ships in the image. Vigilance watches what remains for the update that turns bad. See them side by side below.
Side by Side
| Question | Chainguard | Vigilance |
|---|---|---|
| Gives you a clean base container | Yes | No |
| Proves who built the container | Yes | No |
| Covers the code your own team adds on top | No | Yes |
| Compares your container today against last week | No | Yes |
| Spots a file that now runs a different program than before | No | Yes |
| Covers anything that is not a container | No | Yes |
Which One Do You Need?
Use both. Chainguard shrinks what you start from. Vigilance checks what you add on top.
Known Risk versus New Risk
A bug or a bad package someone already reported, with a name and a number. Most tools work here.
A file that gained a capability it never had, that no report covers yet. Vigilance works here.
Common Questions
Is Vigilance a Chainguard Alternative?
Yes, for one job. Vigilance shows the file that gained a new capability, on your own machine. Many teams run it next to Chainguard.
What Does Vigilance Do That Chainguard Does Not?
Vigilance can spot a file that can do more than the version before, and on Pro run with no internet at all.
What Does Chainguard Do That Vigilance Does Not?
Chainguard finds known bugs that already have a name and a number. Vigilance does not.
Does Vigilance Need the Internet or a Cloud Account?
The Free plan runs online. Pro runs fully offline, with no cloud account.
Try It on Your Own Software.
Show it the version you run today and the one you are about to install.
Talk to Us
A question, a pilot, or a bigger fleet? Send a note. It reaches a person.