# chainctl images overlays

URL: https://chainguard-docs-preview-git-exp-577-mcp-refuse-sse-get.chainguard.app/platform/chainctl/chainctl-docs/chainctl_images_overlays.md
Last Modified: October 8, 2026
Tags: chainctl, Reference, Product

 chainctl images overlays Manage Custom Assembly overlays and the repos they are attached to.
Synopsis Manage tag-based Custom Assembly overlays.
An overlay is a reusable image customization (packages, environment variables, annotations, accounts, and certificates) owned by an organization or folder. Attaching an overlay to a repo — or, with –all-repos, to every repo in an organization, including repos created later — creates a binding that selects which tags the overlay applies to:
–all: every tag. –variant: a tag variant, such as dev. –tag: specific tags. When bindings of different kinds match the same tag, they layer in the order ALL, then VARIANT, then EXACT, with later layers taking precedence; a repo’s own bindings layer above all-repos bindings. Bindings of the same kind may coexist on a repo only when their overlays do not conflict.
The Guarded Entrypoint keys layer per key: fail_mode and command_override come from the most specific binding that sets them, and a binding that leaves one unset uses a broader binding’s value (an empty command_override counts as set and cancels a broader one); guarded_entrypoint is on when any matching binding sets it, but an overlay that sets fail_mode, preflight, or command_override must still set guarded_entrypoint: true itself; preflight checks from every matching binding are combined, broader bindings first. A binding is rejected when it is created if its overlay sets a different fail_mode or command_override than a binding it co-matches in the same layer: two –all bindings, two –variant bindings for one variant, or two –tag bindings sharing a tag.
Chainguard rebuilds the matching images after an overlay or binding changes. These rebuilds run only for organizations enrolled in tag-based Custom Assembly. Contact your Chainguard account team to enroll.
Examples # Create an overlay that adds packages chainctl images overlays create my-overlay --parent my-org --package curl --package jq # Attach it to every tag of a repo chainctl images overlays attach --overlay my-overlay --repo python --parent my-org --all # List overlays and their bindings chainctl images overlays list --parent my-org Options inherited from parent commands --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev") --audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev") --config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly. --console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev") --force-color Force color output even when stdout is not a TTY. -h, --help Help for chainctl --issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev") --log-level string Set the log level (debug, info) (default "ERROR") -o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide] -v, --v int Set the log verbosity level. SEE ALSO chainctl images	- Images related commands for the Chainguard platform. chainctl images overlays attach	- Attach Custom Assembly overlays to a repo or to every repo in an organization. chainctl images overlays create	- Create a Custom Assembly overlay. chainctl images overlays delete	- Delete a Custom Assembly overlay. chainctl images overlays detach	- Detach a Custom Assembly overlay from a repo. chainctl images overlays list	- List Custom Assembly overlays and their bindings. chainctl images overlays update	- Update a Custom Assembly overlay’s name or configuration. chainctl images overlays update-binding	- Change which tags a Custom Assembly overlay binding applies to.