Container Image Security

• Images are the artifact your clusters trust; a supply-chain substitution is a cluster-wide incident.
• The smaller the image, the smaller the attack surface AND the faster the pull — security and speed align.
• Signing + attestation is what lets policy engines enforce 'only images we approved' automatically.

You accept cargo not because the box is pretty, but because the manifest (SBOM) and the seal (signature) say who packed it.

• Golden images: a reviewed base with pinned digests, minimal packages, and a known SBOM.
• Build-time scan: layer diff + CVE gates catch regressions before the artifact exists in a registry.
• Signing: cosign attaches signatures/attestations so policy can verify identity at the source.
• Runtime policy: admission verifies signature + scans before deployment; a unsigned offer is denied.

• A platform denies any image whose digest isn't signed and whose scan isn't clean at admission time.
• A product team switched to distroless for services and sees the CVE-per-image count drop to the single digits.
• A registry's pull policy pins digests, killing the silent 'reuse :latest' drift.

• Pin base digests, not tags; rebuild on the golden image's update schedule.
• Prefer minimal bases (alpine/distroless) and refusal of unpinned or unsigned options.
• Sign every internal build with cosign/Sigstore; verify before admission.
• Gate merges on scan results using verified SBOM data, not a glance.

• Building from :latest and hoping the builder's tags are clean.
• A golden image that nobody updates — drift becomes the new reality silently.
• Signing ceremony that signs every image with a shared key nobody rotates.
• Scanning at build but not gate, so CVEs sail through the deploy anyway.

• When a scan flags a base-layer CVE you can't fix, check whether a newer pinned digest improves it before architecting around the scan.
• Verify a signature locally: cosign verify with the public key, then check the digest matches the deployed image.
• Use SBOM diffs between approvals to catch a registry tag silently changing beneath :latest.

• Signing is only as strong as key hygiene: keep signer keys in a vault, rotate, and audit the ceremony.
• A registry is a trusted boundary — restrict push rights and monitor unexpected tag changes.