Image Layout: Stop Putting Everything in Registries
summary
Argues for writing images and metadata to an OCI image layout on the CI filesystem, running sbom generation (syft/trivy), vulnerability scans (grype/trivy), and attestations locally, then pushing one finished unit to a registry; this reduces network chatter, prevents unscanned/unsigned images leaking, and makes signatures/verifications atomic. Demo uses Buildx, regclient and a temporary zot registry inside a GitHub Actions pipeline to sign and attach sboms; it works as a proof of concept but is single-platform and tooling and reference syntax remain inconsistent.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:30Container Images
- 2:48Image Layers
- 10:14Oci Image Layout
- 11:17Index Json
- 15:58Registry Clients
- 16:25Vulnerability Scanners
- 26:34Make Images Reproducible
- 29:51Conclusion
related talks
36mModifying the Immutable: Attaching Artifacts to OCI Images
31mSigned, Sealed, Delivered - Sign and Verify All the Things
40mAttesting Practically: Exploring the Glue Behind Secure Runtime Environments
36mContainer Registries, No Longer Just for Containers!
32mBack to the Drawing Board: Building Containers with SBoMs
28mRegistries After Dark
24mBack to the Drawing Board: Building Containers with SBoMs
31mSign, Attest, and Verify! A Practical Guide for Software Supply...