软件供应链安全公司 Chainguard 发布两款测试版产品，用于运行和测试开发者与 AI 智能体编写的代码。Chainguard Workspaces 提供基于加固型微型虚拟机的远程开发环境，而 Chainguard Checks 将持续集成能力融入开发流程。该公司在伦敦 Assemble 大会上公布了这两款产品。
推出这两款产品是为了解决代码智能体面临的一个实际难题。智能体需要权限来安装软件包、执行 shell 命令和编辑配置文件，还可能并行执行多项任务。如果在开发者本地电脑上执行这些操作，企业凭证和本地服务就有可能被生成代码或第三方代码访问到。反之，如果将每一处修改都提交给传统 CI 服务则可能造成队列拥堵，并反复下载相同的依赖项。
Workspaces 为每位开发者或智能体分配独立的远程微型虚拟机。通过 chainctl develop 命令将本地工作目录（包括未提交的变更）同步到环境中。当用户断开连接，会生成会话快照，并可在恢复会话后还原文件、进程和 shell 上下文。团队还可以为同一个代码库创建多个相互隔离的 Workspaces，这样智能体就可以尝试多种解决方案，端口、缓存和进程状态互不干扰。
Chainguard 表示，主机端代理会为已批准的出站请求添加短期凭证，而不是在虚拟机内部放置长期密钥。可选的出站规则可以拦截并记录访问未授权端点的连接。该公司还会记录命令、代码变更与网络调用，声称日志具备防篡改特性。Paxton 和 Phillips 表示，这一设计旨在降低依赖包被入侵或提示词注入攻击导致智能体失控带来的损害。
Checks 在独立的预热微型虚拟机中运行 CI 步骤，虚拟机镜像基于 Chainguard 软件包构建。依赖包会根据项目锁定文件预先准备，当锁定文件发生变更时，快照资源池会重新构建。开发者可以通过命令行、提交前钩子或者 GitHub 应用调用相同的检查任务。AI 智能体则可通过 MCP 服务器或 SDK 调用。Paxton 和 Phillips 表示，其目标是让开发者和智能体能够“安全地测试、报错并修复代码，无需等待缓慢的 CI 流程”。
当 Checks 和 Workspaces 一起使用时，Workspace 会在测试运行期间挂起。失败的检查会将结构化日志返回到恢复的会话中，智能体可以尝试另一个变更而无需重建环境。成功的运行会创建一个与环境、结果和提交相关联的证明。提议的合并关卡可以验证该证据，无需再次运行测试套件。
“每次运行都会产生一份签名证明，将环境、判定结果和提交 SHA 绑定在一起，因此合并关卡可以验证通过的结果，而无需重新运行测试。”
这一设计依赖两个前提：被核验的输入内容保持不变，并且代码库信任 Chainguard 的执行与签名系统。本次公告并未公布 Checks 和主流 CI 服务的性能对比数据，也没有说明客户该如何验证日志宣称的防篡改能力。Workspaces 当前支持 Claude，后续计划支持其他智能体，产品按实际消耗算力计费。两款产品均提供 30 天测试试用。
Chainguard 还发布了另外两项和构建流水线相关的公告。Chainguard Actions 现已正式发布，包含超过 1000 个经过重建并持续维护的 GitHub Actions；面向 Go 和 .NET 的 Chainguard Libraries 进入早期预览阶段。Libraries 服务会扫描依赖包中的恶意软件与灰色软件，新增软件包上线前可设置可配置延迟，并为选定漏洞移植修复补丁。Chainguard 报告称，其测试版扫描器已对 5000 多个 Go 和 .NET 软件包完成判定，其中超过 10% 的检测样本在公开数据源中无匹配记录。
Chainguard 入局的市场已有成熟竞品。E2B 在 Firecracker 微型虚拟机中运行智能体会话，控制出站流量，并在虚拟机外部解析凭证。StepSecurity Harden-Runner 监控 GitHub Actions 运行器上的网络、文件与进程活动，可强制执行出站网络策略。在依赖包防护方面，Sonatype Repository Firewall 在构建之前拦截或隔离存在恶意行为与漏洞的软件包；JFrog Curation 在下载阶段执行安全、许可证以及包龄策略。Chainguard 的方案将上述能力整合在一起，附带签名测试结果、重构后的 Actions 以及修复后的依赖包。
将微型虚拟机用于不可信构建任务与智能体工作负载的做法已经相当成熟。InfoQ 在 AI 加速开发安全指南中建议针对由智能体生成的代码采用隔离式微型虚拟机或权限严格受限的容器，同时搭配短期凭证与默认拒绝访问的网络策略。亚马逊 Bedrock AgentCore 为每一个用户会话提供独立隔离的 CPU、内存和文件系统资源；Vercel 的 Hive 构建系统则使用 Firecracker 微型虚拟机以及短期 WireGuard 隧道。Chainguard 的独到之处在于它把这种隔离能力和自家的软件包目录、持续集成证明以及智能体执行路径整合在了一起。
查看英文原文：https://www.infoq.com/news/2026/10/chainguard-workspaces-checks/
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
The software supply chain security company Chainguard publish, a pilot version of the product, was used to run and test codes prepared by developers and AI AI agent. Chainguard Workspaces provides a remote development environment based on a hardened microvirtual machine, while Chainguard Checks integrates continuous integration capabilities into the development process. The company announced both products at the Assembly of Assemble in London.
These two products were introduced to address a practical challenge to code AI agent. AI agent requires permission to install software packages, execute shell commands and edit configuration files, and may perform multiple tasks in parallel. If these operations are carried out on the developer ' s local computer, business vouchers and local services may be accessed by generating codes or third-party codes. Conversely, if each change is submitted to the traditional CI service, it can cause a crowding and repeat downloads of the same dependencies.
Workspaces assigns a stand-alone, remote microvirtual machine to each developer or AI agent. Sync local working directory (including unsubmitted changes) to the environment by means of chanctl development command. When the user is disconnected, a session snapshot is generated and the file, process and shell context can be restored after the session has resumed. The team can also create multiple workspaces for the same code library so that AI agent can try multiple solutions without interference between ports, cache and process state.
Chainguard states that the host agent will request a short-term voucher for an approved exit, instead of placing a long-term key inside the virtual machine. Optional exit rules can intercept and record access to unauthorized endpoints. The company also recorded orders, code changes and network calls, claiming that the logs were anti-false. Paxton and Phillips stated that the design was designed to reduce the damage caused by the loss of control of AI agent as a result of the invasion of the relying package or the injection of prompt.
Checks runs the CI step in a stand-alone preheat micro-virtual machine, which is based on the Chainguard package. The relying package is pre-prepared for locking on the project file and the snapshot pool is reconstructed when the lock file changes. Developers can call for the same inspection tasks through command line, pre-submission hooks or GitHub applications. AI AI agent can be called via the MCP server or SDK. According to Paxton and Phillips, the objective is to enable developers and AI agent to “test, erroneously and repair the code safely without waiting for slow CI processes”.
When CHecks and Workspaces are used together, the Workspace is hung during the test run. The failed check returns the structured log to the restored session, where AI agent can try another change without rebuilding the environment. Successful operations create a link to the environment, results and submissions. The proposed consolidation level validates the evidence without having to run the test package again.
“Each operation will produce a signature certificate that binds the environment, the decision results and the submission of SHA together, so that the combined level can validate the passed result without having to re-run the test.”
This design relies on two premises: the verified input content remains unchanged and the code library trusts the Chainguard implementation and signature system. The bulletin does not publish comparative data on the performance of Checks and mainstream CI services, nor does it indicate how the customer should verify the anti-false alteration capability claimed in the log. Workspaces currently supports Claude, and the follow-up plan supports other AI agents, with the product based on actual consumption. Both products offer a 30-day test trial.
Chainguard has also publish in two other announcements related to the construction of the current line. Chainguard Actions are now officially publish, which contains more than 1,000 GitHub Actions that have been rebuilt and maintained on an ongoing basis; Chainguard Libraries for Go and.NET are entering the early preview phase. The Librries service scans both malicious and grey software in the package, setting up configuration delays before the new package goes online and repairing patches for selected leak transplants. Chainguard reported that its test version scanner had completed the determination of more than 5,000 Go and.NET packages, of which more than 10 per cent tested sample had no matching records in open data sources.
The Chainguard market has matured. E2B runs AI agent sessions in Firecracker mini-virtuals, controls out-of-station traffic and interprets vouchers externally on virtual machines. StepSecurity Harden-Runner monitors network, file and process activities on the GitHub Actions operator, which enforces the exit network policy. In terms of relying on package protection, Sonatipe Repository Firewall intercepts or isolates software packages with malicious acts and loopholes prior to construction; and JFrogCuration implements security, licensing and package age strategies during the download phase. The Chainguard programme combines the above capabilities with the results of signature tests, the reconstructed Actions and the restored dependency packages.
The use of mini-virtual machines for untrustworthy tasks and the AI agent task load is well established. In the AI Accelerating Development Security Guide, InfoQ recommends the use of isolated mini-virtuals or severely restricted containers of permission for codes generated by AI agent, along with short-term vouchers and a default web-based strategy to deny access. The Amazon Bedrock AgentCore provides a stand-alone CPU, memory and file system resource for each user session; the Vercel Live build system uses Firecracker microvirtuals and short-term WireGuard tunnels. Chainguard's uniqueness lies in its integration of this isolation capability and its home-based package catalogue, the continuous integration certificate and the AI agent implementation path.
See the original English language version at https://www.infoq.com/news/2026/10/chaingual-workspaces-checks/
Auto-fetched and translated by AI Atlas. All rights belong to the original author.