Start Securing your Base Images by Making your Own Distroless
summary
Research finds popular base images average 287 vulnerabilities with 30% high/critical, so this shows a reproducible workflow: build minimal distroless images from Wolfi using apko/apq, publish images annotated with OCI/ko base-image fields, sign artifacts with cosign and record in a transparency log, then enforce runtime checks with Kyverno/Chiron policies that validate the base-image annotation and signature. Demo builds a tar image, verifies zero CVEs, signs it, and blocks unsigned or unknown-base images at admission.
AI-written summary · about
chapters (13)
- 0:00KCD Pakistan intro
- 1:47Base and parent images
- 3:53Vulnerable base image risks
- 6:02Distroless and Chained images
- 8:13Secure images with apko and wolfi
- 10:41Wolfi OS and Kyverno
- 11:23Demo setup with apko
- 13:54Secure base image creation
- 16:46Container image build
- 18:37Signing images with cosign
- 19:20Runtime validation with Kyverno
- 21:29Policy enforcement
- 22:36Final demo and conclusion
related talks
33mBuilding Images For The Secure Supply Chain
39mA Journey to Distroless
28mBuilding Images for the Secure Supply Chain
20mHow Secure is Your Base Image? ...
37mSupply Chain Security in Kubernetes
35mSecuring Containers by Breaking In
36mHow to Prevent Your Kubernetes Cluster From Being Hacked — Nico Meisenzahl and Philip Welz
49mSecure Container Images with Chainguard's Tooling: Melange, Apko & Wolfi