[Rodrigo-Munoz-Salas]

Linear: CHU-96

Adds the runtime Java truststore to the Guarded Entrypoint pages. A Java application can now trust a CA that exists only at run time, such as an OpenShift service CA that rotates, or a private CA on ROSA. The pages describe the feature and show examples. They keep low-level detail to a minimum.

What changed

All under content/chainguard/containers/custom-assembly/:

• guarded-entrypoint/how-it-works.md: a new Java truststore section with the manifest keys, the deploy-time GUARDED_TRUSTSTORE_0 setting, the volumes to mount (including /tmp on FIPS images and the Keycloak note), and USE_SYSTEM_CA_CERTS.
• guarded-entrypoint/overview.md: the truststore manifest key next to the other four, the truststores API field with a request example, how the field layers across bindings, and its rows in the API error table. The permission-denied row now quotes the message as it ships, which sends customers to customer support.
• guarded-entrypoint/examples.md: a Java service that trusts a mounted service CA, with its manifest and Deployment, and deploy-time variants.
• guarded-entrypoint/troubleshooting.md: exit code 128 in the exit-code table, and a section for a container that doesn't trust a mounted CA.
• guarded-entrypoint/trust-boundary.md: the store holds certificates only, and the password is never logged or put on a command line.
• custom-assembly-certs.md, overlays/overview.md, and overview.md: one-line pointers to the truststore, plus one broken link fixed. The link to Chainguard OS Packages on the overview pointed at an anchor that no longer exists. It now points to the Chainguard OS Packages page.

How this was checked

• Every manifest on the Guarded Entrypoint pages parses and validates with the code that chainctl images repos build edit, apply, and images overlays create -f use. The JSON request bodies parse against the public API protos. The Deployment and container snippets decode strictly against the Kubernetes types. I did not run kubectl, because it needs a live cluster.
• The error table rows match the messages that the API returns today, or the literals in the source where I couldn't produce the error.
• The wrapper details match the wrapper README at the v0.2.389 release tag.
• The site builds locally, and markdownlint reports no issues. The tag, weight, and spell checks pass.
• I checked every internal link and anchor in the Custom Assembly section against the built site, and every external URL with a request. The only link that doesn't answer is the Mozilla wiki page that the certificates page links to. The wiki is down for maintenance at the moment.

For the reviewer

• The truststore keys, examples, and exit code come from the current wrapper and the Custom Assembly field. They need a chainctl release that supports the truststore key. The pages tell readers to use the latest chainctl.
• The Overlays enrollment error still says to contact your Chainguard account team. That is the message as it ships.

🤖 Generated with Claude Code

[vercel]

@Rodrigo-Munoz-Salas is attempting to deploy a commit to the Chainguard Team on Vercel.

A member of the Team first needs to authorize it.

[matthewhelmke]

Thank you!!

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
chainguard-docs-preview	Ready	Preview	Oct 22, 2026 1:24pm UTC