The State of Your Supply Chain
summary
Describes treating containers as immutable artifacts and proving provenance from base image to deployment, showing how to rebuild and redeploy a vulnerable image automatically. Explains hermetic, reproducible builds, hash‑addressed images, and enforcement via an admission controller that checks attestations and vulnerability metadata. Covers specific tools and integrations: Clair, Micro Scanner and Notary, plus Grafeas, Kritis, in‑toto and TUF, and demonstrates blocking high‑severity CVEs by rebuilding images rather than patching live containers.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:56What is a software supply chain?
- 2:13Software supply chains can be exploited
- 8:11Code
- 13:19Deploy
- 18:02Docker Hub
- 18:34TUF vs Notary
- 19:36The Update Framework (TUF)
- 23:32Grafeas: concepts
- 27:52Image vulnerability scanning approaches
related talks
28mBuilding Images for the Secure Supply Chain
48mContainer Security: It’s All About the Supply Chain
38mSecuring the chains: Building defensive layers for software supply chains
30mEstablishing Image Provenance and Security in Kubernetes - Adrian Mouat, Container Solutions
18mPractical End-to-End Container Security at Scale
34mDelivering Continuous Security with Docker
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
26mSecure and Reliable Container Image Creation with Shipwright in the Supply Chain