From Podman to Prod: Building Trusted Container Images with Konflux on OpenShift
summary
Moves a simple Flask app from a local Podman build to a Konflux Tekton pipeline on OpenShift, using a Fedora 44 base, buildah/builder and hermeta to prefetch dependencies; the pipeline runs a network=none hermetic build, generates an SBOM, runs CVE and malware scans, and performs keyless cosign signing and attached attestations. Konflux produces SLSA level 3 provenance, pushes the image to Quay, and enforces an enterprise contract that blocks releases when checks fail; the demo shows three cosign signatures, SBOM, and attestations retrievable by digest.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:07Flask API container locally
- 2:33Local build limitations
- 3:57Konflux vs traditional CI
- 5:25Konflux introduction
- 6:28CI with Konflux on OpenShift
- 8:17Hermetic builds
- 9:42Signing and provenance
- 10:26Policy enforcement
- 11:48Verify images with cosign
- 12:52Reuse Podman files
- 13:35Open-source benefits
- 14:20Q&A
related talks
14mBuild It Your Way: Modular Pipelines for Bootable Containers
19mWho Are You Building For: Pipelines Have a Purpose
53mFinding, Building, Sharing & Deploying Containers
20mSimplifying Kubernetes: Streamlining Secure App Deployment in DevSecOps
20mSecure Delivery Using Flux and Open Component Model
27mHigh-Security, Zero-Connectivity & Air-Gapped Clouds: Delivering Complex Software with the Open Component Model & Flux
38mAutomated & Observable Deployments with Flux + Keptn
30mAdventures in Production with GitOps, Secure Pipelines & Compliance