Dockerize Securely: SBOMs + Attestations + Bake
summary
Explains how to generate SBOMs during docker build (buildkit flag) so multi-stage dependencies get included, how Docker Scout auto-uses attached SBOMs to find CVEs, and how to attach provenance and sign artifacts with cosign. Shows using docker bake to codify builds and generate SBOMs/provenance, and cites dhi.io hardened images cutting Node CVEs ~25% in one comparison. Recommends periodic rescanning and rebuilding images and notes signing SBOMs requires separate cosign steps.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:01Speaker and CVEs
- 6:13Software Bill of Materials
- 10:09Attaching SBOMs to images
- 13:26Hardening with DHI
- 18:50Docker Bake builds
- 24:21Demo and repo walkthrough
- 27:59Q&A vulnerability checks
- 31:45Signing SBOMs and images
- 32:28Quiz and closing
related talks
32mBack to the Drawing Board: Building Containers with SBoMs
24mBack to the Drawing Board: Building Containers with SBoMs
21mSecuring Dockerized apps in the Microsoft ecosystem
28mBuilding Images for the Secure Supply Chain
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
05mSupple Supply Chain Security With kpack!
23mViewing images through layered SBOMs
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image