Supply Chain Security for Containers

Use minimal, verified sources with long-term support to minimize potential vulnerabilities and ensure ongoing security updates. Regularly audit your base image selections for known issues.

Automate the generation of SBOMs using dedicated tools and store them securely as artifacts within a version control system. This provides an immutable record of your software dependencies, facilitating vulnerability management.

Implement keyless signing for images to verify their authenticity and integrity at deployment time. Regularly rotate keys and maintain strict access controls over signing processes.

Employ severity-based gating to prioritize vulnerability remediation efforts, focusing on the most critical risks first. Establish a clear process for tracking and addressing vulnerabilities throughout the container lifecycle.

Prevent the inclusion of sensitive information within images by using secrets management solutions or environment variables at runtime. Regularly scan images for leaked secrets to mitigate potential exposure risks.

Utilize admission controllers with clearly defined rules to enforce security policies during container deployments, restricting access and preventing unauthorized modifications.

Restrict egress traffic from private registries and implement image allowlists to control which images can be deployed within your environment. This adds an extra layer of defense against compromised or malicious images.

Detect configuration changes in running containers compared to a baseline and automatically reconcile them with the desired state, ensuring ongoing compliance and security posture.

Standardize supply chain security controls across all cloud platforms you utilize to maintain consistency and simplify governance. Leverage automation and centralized management tools for efficient operations.

Maintain comprehensive attestations and audit logs throughout the container supply chain, providing verifiable evidence of compliance and security controls for regulatory audits or internal assessments.