Container Images & Security 101: 5 Need to Know Facts
summary
Container images are concrete object graphs: an image is a manifest config layers trio hashed into a DAG so runtimes verify each piece, and multiarch indexes can contain multiple manifests (Alpine example has eight platform entries). Signing uses cosign and notation with OCI 1.1 artifact metadata and the OCI 1.1 refers API for registry lookups. Images can carry encrypted layers (oci cryp), attestations and SBOMs (BuildKit example shows 12 manifest refs with six attestations), and the format is extensible for WASM and Homebrew packaging.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:10Container image specs history
- 7:11Exploring container images
- 11:29Image signing with sigstore
- 19:01Encrypting image layers
- 22:39OCI image format extensibility
- 27:59Secure supply chain & OCI 1.1
- 30:52BuildKit and Kubernetes features
- 33:24Q&A
related talks
47mContainer Security, Are You Doing It Wrong?
42mDid you sign this (image)?
36mModifying the Immutable: Attaching Artifacts to OCI Images
44mModifying the Immutable: Attaching Artifacts to OCI Images
48mContainer Security: It’s All About the Supply Chain
27mContainer Security Best Practices
43mContainer Security: So Many Options, Use Them All!
30mMaster the Container Security Model with