Back to the Drawing Board: Building Containers with SBoMs
summary
Argues for producing SBOMs during container builds so metadata survives slimming and multi-stage steps, demonstrates using builder to assemble a debian base image, running turn to generate SBOMs, pushing artifacts with auras, and signing images and SBOMs with cosine; demo builds a Debian image, adds Python, generates per-layer SBOMs and signatures, and pushes to a local registry successfully but creates many repos/tags because registries lack a link between images and supplemental artifacts, motivating the OCI artifact references proposal to carry signed SBOMs alongside images.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:25What is an SBOM?
- 2:12In The Beginning...
- 3:39The Desktop Container
- 5:13More Innovation!
- 7:25Solution to the Invisible Software Supply Chain
- 8:21How File Scanners work
- 12:53Building Transparency Into Container Builds
- 14:16A Starting point
- 24:40Filling in the Gaps - Artifact Management
- 28:32Where to get involved
- 30:49Resources
related talks
24mBack to the Drawing Board: Building Containers with SBoMs
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
37mDockerize Securely: SBOMs + Attestations + Bake
27mSBOM: The Rest Of the Story
38mThe State of SBOMs
46mSBOMs Are Not Enough
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
05mGetting Started Getting Started with Containers