Every container image travels the same route before it reaches production: a base image is layered with application dependencies, the whole thing is built into an image, and that image is pushed to a registry a cluster later pulls from. Four independent checkpoints sit along that route, each catching a different class of problem:
- Vulnerability scanning matches every package in the base image and dependency layers against known-CVE databases — it catches disclosed flaws but not custom malicious code that has never been reported.
- SBOM (Software Bill of Materials) is the exact inventory of everything that ended up in the image. It doesn't block anything by itself, but it is the record every later audit or incident response depends on.
- Signing (e.g. Sigstore/cosign) cryptographically attests "this exact image came out of our trusted build" — an image built or altered outside that pipeline simply has no valid signature to present.
- Admission control is the last gate: a Kubernetes admission controller (Kyverno, OPA Gatekeeper, or Sigstore's policy-controller) refuses to schedule any image whose signature doesn't verify, whose SBOM is missing, or whose scan carries an unresolved critical CVE — no matter how it got into the registry.
The "compromised" scenario mirrors the SolarWinds pattern: an unauthorized dependency is slipped into the build outside the normal, signed pipeline. It carries no known CVE, so the scan passes; the SBOM flags it as unexpected but that alone doesn't stop a push. It reaches the registry unsigned — and it is the admission controller, checking for a valid signature at deploy time, that finally refuses to run it in the cluster.