中文
devexamples
← Workflows

阅读中文版本

Container Image Supply Chain Workflow

Pin base images by digest, scan layers, sign images, verify signatures at deploy, and record provenance so only trusted images run.

advanced~150 minsecuritycontainerssupply-chain

Objective

Secure the container image supply chain from base image through deployment admission.

Environment

  • A container registry with signing support
  • A scan tool and a deploy-time verifier

Steps

1. Pin base images by digest

Pin base images by digest and rebuild on a schedule.

Expected state: The build starts from a known base.

2. Scan images for vulnerabilities and fail

Scan images for vulnerabilities and fail on policy thresholds.

Expected state: Known-bad images do not ship.

3. Sign images after build and record

Sign images after build and record provenance.

Expected state: The artifact carries verifiable trust.

4. Verify signatures and provenance at deploy

Verify signatures and provenance at deploy admission.

Expected state: Only trusted images run.

Decision points

Fail the build or just warn on scan?

  • Fail on critical/high
  • Warn only

Fail on critical and high with a documented exception path; warnings alone are ignored.

Verify at admission or in the pipeline?

  • Both
  • Pipeline only

Both; admission catches images that bypassed the pipeline.

Expected outcome

Images built from pinned bases, scanned, signed with provenance, and admitted at deploy only after signature verification.

Verification

Confirm an unsigned or tampered image is rejected at admission and that the deployed image digest matches the signed digest.

Cleanup

Retain signatures and provenance records for the retention period.

Overview

Secure the container image supply chain from base image through deployment admission. Confirm an unsigned or tampered image is rejected at admission and that the deployed image digest matches the signed digest.

Steps

  1. Pin base images by digest and rebuild on a schedule. Expected state: The build starts from a known base.
  2. Scan images for vulnerabilities and fail on policy thresholds. Expected state: Known-bad images do not ship.
  3. Sign images after build and record provenance. Expected state: The artifact carries verifiable trust.
  4. Verify signatures and provenance at deploy admission. Expected state: Only trusted images run.
cosign sign --key cosign.key $IMAGE
docker pull $IMAGE # then verify
cosign verify --key cosign.pub $IMAGE
# admission policy rejects unsigned images

Verification

  • Images built from pinned bases, scanned, signed with provenance, and admitted at deploy only after signature verification.

Decision points

  • Fail the build or just warn on scan? Options: Fail on critical/high; Warn only. Recommended: Fail on critical and high with a documented exception path; warnings alone are ignored.
  • Verify at admission or in the pipeline? Options: Both; Pipeline only. Recommended: Both; admission catches images that bypassed the pipeline.