# Chainguard Registry vs Pulp

**Leader by vioscaleAI score:** Chainguard Registry

| Attribute | Chainguard Registry | Pulp |
|---|---|---|
| **vioscaleAI score** | 59.3 (71% (medium)) | 49.2 (45% (low)) |
| activity.commits_last_30d | - | 61 |
| adoption.dependent_repos | - | 65 |
| adoption.github_stars | - | 609 |
| content.faq | `[{"answer":"A distribution of minimally-configured container images and software packages that receive frequent security updates from source code. All artifacts include SBOMs and provenance documentation to support supply chain security and compliance verification. It is indexed under Container Registries.","source":"https://www.chainguard.dev/unchained/unlock-the-full-chainguard-containers-catalog-now-with-a-catalog-pricing-option","question":"What is Chainguard Registry?","confidence":0.6},{"answer":"Chainguard Registry does not publish its prices. Pricing is quoted on request, across 2 plans (Catalog Pricing and Per-Image Pricing), so the figure depends on your seat count and requirements. We record this as a pricing-transparency signal rather than guessing a number. Pricing changes often, so verify at source before relying on it.","source":"https://www.chainguard.dev/unchained/unlock-the-full-chainguard-containers-catalog-now-with-a-catalog-pricing-option","question":"How much does Chainguard Registry cost?","confidence":0.6},{"answer":"Chainguard Registry supports the web and a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://www.chainguard.dev/unchained/unlock-the-full-chainguard-containers-catalog-now-with-a-catalog-pricing-option","question":"What platforms does Chainguard Registry support?","confidence":0.6},{"answer":"We have only confirmed a cloud / SaaS deployment for Chainguard Registry, so it appears to be vendor-hosted. If a self-hosted option exists we have not found it documented publicly.","source":"https://www.chainguard.dev/unchained/unlock-the-full-chainguard-containers-catalog-now-with-a-catalog-pricing-option","question":"Can Chainguard Registry be self-hosted?","confidence":0.6},{"answer":"We have confirmed 12 integrations for Chainguard Registry, including Cursor, AWS Security Hub, Wiz, GitHub, npm, SAP Cloud Application Programming Model, Kubernetes and Kiro, plus 4 more. This is what we could verify from public sources, so the vendor may support others we have not indexed.","source":"https://www.chainguard.dev/unchained/unlock-the-full-chainguard-containers-catalog-now-with-a-catalog-pricing-option","question":"What does Chainguard Registry integrate with?","confidence":0.6},{"answer":"We have independently confirmed SOC 2, HIPAA and GDPR for Chainguard Registry. Certifications we do not list are ones we have not been able to verify from public sources, which is not the same as Chainguard Registry not holding them. Always confirm compliance directly before you rely on it.","source":"https://www.chainguard.dev","question":"What security certifications does Chainguard Registry have?","confidence":0.48},{"answer":"Chainguard Registry is available worldwide. Its primary market is the United States.","source":"https://www.chainguard.dev/unchained/unlock-the-full-chainguard-containers-catalog-now-with-a-catalog-pricing-option","question":"Where is Chainguard Registry available?","confidence":0.5}]` | `[{"answer":"Pulp enables developers and operators to fetch, upload, organize, and distribute software packages across on-premises infrastructure or cloud environments. It supports multiple content types through a plugin architecture and provides tools for repository management at scale. It is indexed under Container Registries.","source":"https://pulpproject.org","question":"What is Pulp?","confidence":0.6},{"answer":"Pulp is open source, so it can be self-hosted and used at no licence cost. It is released under the GPL-2.0 licence. Pricing changes often, so verify at source before relying on it.","source":"https://pulpproject.org","question":"Is Pulp free to use?","confidence":0.6},{"answer":"Pulp supports a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://pulpproject.org","question":"What platforms does Pulp support?","confidence":0.6},{"answer":"Yes. Pulp can be deployed cloud / SaaS, on-premise and self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://pulpproject.org","question":"Can Pulp be self-hosted?","confidence":0.6},{"answer":"We have independently confirmed GDPR for Pulp. Certifications we do not list are ones we have not been able to verify from public sources, which is not the same as Pulp not holding them. Always confirm compliance directly before you rely on it.","source":"https://pulpproject.org/help/more/governance/privacy/","question":"What security certifications does Pulp have?","confidence":0.7},{"answer":"Yes. Pulp is published under the GPL-2.0 licence, a copyleft licence, so check its terms before embedding it in a closed-source product. Licence terms can change between releases, so verify against the repository for the version you intend to use.","source":"https://github.com/pulp/pulpcore","question":"Is Pulp open source?","confidence":0.95},{"answer":"Pulp is available worldwide. The vendor is headquartered in the United States.","source":"https://pulpproject.org","question":"Where is Pulp available?","confidence":0.75}]` |
| deployment.options | `{"cloud":true,"on_prem":true,"self_hosted":true}` | `{"self_hosted":true}` |
| description.long | A registry service providing pre-hardened container images, language libraries, and VM images built with security-first design and continuously patched against vulnerabilities. Designed to reduce engineering overhead and ensure compliance without manual security management. | Pulp is an open-source platform that enables you to mirror, host, and manage repositories of software packages and content. It allows you to organize content promotion across multiple repositories and enforce access controls through flexible content guards. |
| features.capabilities | `{"web_ui":true,"hosting":"cloud","sbom_support":true,"image_signing":true,"oci_compliant":true,"private_repos":true,"artifact_types":"universal","pull_rate_limits":"none","replication_mirroring":true,"vulnerability_scanning":true}` | `{"rbac":true,"web_ui":true,"hosting":"both","sbom_support":false,"image_signing":false,"oci_compliant":true,"private_repos":true,"artifact_types":"universal","cloud_iam_native":false,"pull_rate_limits":"none","high_availability":false,"pull_through_cache":false,"replication_mirroring":true,"vulnerability_scanning":false}` |
| integrations.count | 19 | 2 |
| integrations.list | `[{"name":"Cursor"},{"name":"AWS Security Hub"},{"name":"Wiz"},{"name":"GitHub"},{"name":"GitHub Actions"},{"name":"npm"},{"name":"SAP Cloud Application Programming Model"},{"name":"Kubernetes"},{"name":"Kiro","native":true},{"name":"Grype"},{"name":"Trivy"},{"name":"AWS Inspector"},{"name":"Anchore Enterprise"},{"name":"Snyk","native":true,"category":"security"},{"name":"GitLab","native":true,"category":"security"},{"name":"CrowdStrike","native":true,"category":"security"},{"name":"Qualys","native":true,"category":"security"},{"name":"JFrog Artifactory","native":true,"category":"artifact-management"},{"name":"Cloudsmith","native":true,"category":"artifact-management"},{"name":"Harbor","native":true,"category":"artifact-management"},{"name":"Nexus","native":true,"category":"artifact-management"},{"name":"Google Artifact Registry","native":true,"category":"artifact-management"},{"name":"Docker Hub","native":true,"category":"artifact-management"},{"name":"Amazon ECR","native":true,"category":"artifact-management"},{"name":"Microsoft ACR","native":true,"category":"artifact-management"}]` | `[{"name":"OpenAI API"},{"name":"GitHub"}]` |
| language.primary | - | Python |
| license.spdx | - | GPL-2.0 |
| market.availability | `{"primaryMarkets":["US"],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | `{"hqCountry":"US","primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` |
| platform.support | `{"cli":true,"web":true}` | `{"cli":true,"web":true}` |
| pricing | `{"type":"subscription","plans":[{"free":true,"name":"Free","features":["5 images per organization","Base, Application, and AI/ML images","No CVE remediation SLA"],"components":[{"kind":"fixed","amount":0,"currency":"USD"}],"description":"5 container images for testing and production deployment","contactSales":false,"includedLimits":{"images":"5"}},{"free":false,"name":"Catalog","summary":"$19K/year for team of 10 (full container catalog access)","features":["Full access to 3,000+ images","Unlimited pulls with no metering","CVE remediation SLA (7 days critical, 14 days high/medium/low)","SLSA L3 hardened infrastructure","Sigstore signed artifacts with build-time SBOMs and attestations","STIG-hardened and FIPS-validated images","Private APK Repository (10,000+ packages)","Custom Assembly tooling"],"minSeats":10,"components":[{"kind":"fixed","amount":19000,"period":"year","currency":"USD"}],"description":"Full access to 3,000+ container images with enterprise CVE remediation SLA","contactSales":false},{"free":false,"name":"Per-Image","features":["Flexible licensing by image count and type (base, app, AI/ML, FIPS)","CVE remediation SLA"],"description":"Licensed by number and type of container images used","contactSales":true},{"free":false,"name":"Libraries","features":["Python, Java, JavaScript libraries","Unlimited applications per language with no metering","Cross-compatibility across Linux distributions"],"description":"Language library packages licensed by developer tier","contactSales":false},{"free":false,"name":"Virtual Machines","features":["Minimal hardened OS images for general use or language runtimes","CVE remediation SLA","Multi-cloud and on-premises support"],"description":"Hardened VM images with enterprise support","contactSales":true}],"summary":"Free tier with 5 images. Paid plans from $19K/year for catalog access.","currency":"USD","freeTier":true,"sourceUrl":"https://www.chainguard.dev/pricing","retrievedAt":"2026-10-05T10:10:26.962Z","startingPrice":{"amount":19000,"period":"year","currency":"USD"},"billingPeriods":["month","year"]}` | `{"type":"open_source","freeTier":true,"sourceUrl":"https://pulpproject.org","retrievedAt":"2026-08-16T21:32:46.974Z"}` |
| pricing.free_tier | yes | yes |
| pricing.model | freemium | open_source |
| pricing.price_level | high | free |
| pricing.starting_price | `{"amount":19000,"currency":"USD"}` | - |
| pricing.transparent | no | yes |
| release.history | - | `[{"url":"https://github.com/pulp/pulpcore/releases/tag/3.122.2","date":"2026-10-15T19:15:35Z","type":"stable","version":"3.122.2"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.122.1","date":"2026-10-15T14:18:39Z","type":"stable","version":"3.122.1"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.118.3","date":"2026-10-15T19:36:43Z","type":"stable","version":"3.118.3"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.105.23","date":"2026-10-15T19:16:18Z","type":"stable","version":"3.105.23"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.122.0","date":"2026-10-14T16:36:25Z","type":"stable","version":"3.122.0"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.105.22","date":"2026-10-14T15:42:29Z","type":"stable","version":"3.105.22"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.85.32","date":"2026-10-14T15:42:53Z","type":"stable","version":"3.85.32"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.118.2","date":"2026-10-13T16:00:17Z","type":"stable","version":"3.118.2"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.121.3","date":"2026-10-09T19:53:11Z","type":"stable","version":"3.121.3"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.121.2","date":"2026-10-08T15:45:41Z","type":"stable","version":"3.121.2"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.121.1","date":"2026-10-08T10:00:44Z","type":"stable","version":"3.121.1"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.121.0","date":"2026-10-06T15:24:30Z","type":"stable","version":"3.121.0"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.105.21","date":"2026-10-01T14:19:40Z","type":"stable","version":"3.105.21"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.120.0","date":"2026-09-29T14:56:40Z","type":"stable","version":"3.120.0"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.119.2","date":"2026-09-29T14:18:14Z","type":"stable","version":"3.119.2"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.73.45","date":"2026-09-24T08:43:01Z","type":"stable","version":"3.73.45"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.49.71","date":"2026-09-24T08:44:30Z","type":"stable","version":"3.49.71"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.119.1","date":"2026-09-23T14:33:29Z","type":"stable","version":"3.119.1"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.119.0","date":"2026-09-23T10:32:05Z","type":"stable","version":"3.119.0"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.105.20","date":"2026-09-23T14:33:40Z","type":"stable","version":"3.105.20"}]` |
| reliability.status_page | yes | - |
| security.certifications | `[{"name":"FIPS-validated","status":"active"}]` | - |
| security.fedramp | yes | - |
| security.gdpr | yes | yes |
| security.hipaa | yes | - |
| security.pci | yes | - |
| security.soc2 | yes | - |
| security.trust_center | https://www.chainguard.dev/unchained/ | - |
| security.vulnerabilities | - | `{"count":2,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=pypi&package_name=pulpcore&per_page=100","last_12m":0,"max_severity":"HIGH"}` |

## Capabilities (Container Registries)

| Capability | Chainguard Registry | Pulp |
|---|:--:|:--:|
| **Deployment** |  |  |
| Hosting | Cloud only | Cloud + self-hosted |
| **Standards** |  |  |
| OCI Distribution Spec compliant | ✓ | ✓ |
| **Scope** |  |  |
| Artifact types | Universal (images + language packages) | Universal (images + language packages) |
| **Security** |  |  |
| Built-in vulnerability scanning | ✓ | ✗ |
| Image signing (Cosign/Notation) | ✓ | ✗ |
| SBOM generation / storage | ✓ | ✗ |
| **Access** |  |  |
| Fine-grained RBAC / robot accounts | - | ✓ |
| Private repositories | ✓ | ✓ |
| **Distribution** |  |  |
| Geo-replication / mirroring | ✓ | ✓ |
| Pull-through cache / proxy | - | ✗ |
| **Integration** |  |  |
| Native cloud IAM integration | - | ✗ |
| **Pricing** |  |  |
| Pull-rate limits | None | None |
| **UX** |  |  |
| Web UI / console | ✓ | ✓ |
| **Ops** |  |  |
| High-availability deployment | - | ✗ |

*Source: vioscaleAI. Generated 2026-10-16T20:59:45.473Z. "-" = undocumented, not absent.*