# Guarded Entrypoint for Custom Assembly

URL: https://chainguard-docs-preview-git-tpchecks-org-config-scope.chainguard.app/chainguard/containers/custom-assembly/guarded-entrypoint.md

How Guarded Entrypoint lets a Custom Assembly image resolve secrets, run preflight checks, and override its command at container start, and how to turn it on.

## Pages

- [Guarded Entrypoint for Custom Assembly](https://chainguard-docs-preview-git-tpchecks-org-config-scope.chainguard.app/chainguard/containers/custom-assembly/guarded-entrypoint/overview.md): How Guarded Entrypoint lets a Custom Assembly image resolve secrets, write a Java truststore, run preflight checks, and override its command at container start, and how to turn it on.
- [How Guarded Entrypoint works](https://chainguard-docs-preview-git-tpchecks-org-config-scope.chainguard.app/chainguard/containers/custom-assembly/guarded-entrypoint/how-it-works.md): What the Guarded Entrypoint wrapper does at container start: secret references, fail mode, the Java truststore, preflight checks, command override, and variable expansion.
- [Guarded Entrypoint examples](https://chainguard-docs-preview-git-tpchecks-org-config-scope.chainguard.app/chainguard/containers/custom-assembly/guarded-entrypoint/examples.md): Example Custom Assembly manifests that use Guarded Entrypoint to inject secrets, wait for a dependency, override a command, fail open, and trust a mounted CA in a Java service.
- [Troubleshoot a wrapped container](https://chainguard-docs-preview-git-tpchecks-org-config-scope.chainguard.app/chainguard/containers/custom-assembly/guarded-entrypoint/troubleshooting.md): How to recover a container that fails to start under Guarded Entrypoint, what the wrapper's exit codes mean, and how a refused build appears in chainctl.
- [Guarded Entrypoint trust boundary](https://chainguard-docs-preview-git-tpchecks-org-config-scope.chainguard.app/chainguard/containers/custom-assembly/guarded-entrypoint/trust-boundary.md): What the Guarded Entrypoint wrapper connects to, what it never does, and what is visible in the image configuration.