Secure and Reliable Container Image Creation with Shipwright in the Supply Chain
summary
75% of container images in production show high or critical vulnerabilities and 85% of those have available fixes; Shipwright breaks builds so BuildKit or other strategies produce an OCI rootfs on the build pod, then Shipwright runs post-processing (examples: Syft for SBOMs, Trivy for vulnerability scans), attaches SBOMs as OCI artifacts, enriches the BuildRun with vulnerability metadata, and can abort pushes to registries so unsafe images never get pushed.
AI-written summary · about
chapters (11)
- 0:00Container image vulnerabilities
- 1:25Shipwright for secure builds
- 3:55Shipwright core concepts
- 5:41Shipwright inner workings
- 8:51Build strategy post-processing
- 12:01SBOM and vulnerability scanning demos
- 16:19Automating SBOM creation
- 17:22Vulnerability scanning in builds
- 20:10Future post-processing use cases
- 21:57Q&A: Shipwright & Tekton
- 24:39Closing remarks
related talks
35mThe State of Your Supply Chain
38mSecuring the chains: Building defensive layers for software supply chains
21mWhat is the Best Container Security Workflow for Your Organization?
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
24mSecuring Container Workloads
48mContainer Security: It’s All About the Supply Chain
28mBuilding Images for the Secure Supply Chain
30mMaster the Container Security Model with