Back to the Drawing Board: Building Containers with SBoMs
Talkat KubeCon + CloudNativeCon North America 2021 · on Wednesday, 2021-10-13· at 11:00· Petree Hall D + Online·
summary
Containers lose package metadata during multi-stage builds and docker-slim, so static scanners miss contents. Demonstrates how to generate SBoM at build time by mounting the build container, running Tern to produce SPDX JSON SBoMs, pushing image and SBoM to a local OCI registry with ORA, and signing both with cosign. Demo builds a minimal Debian image, layers a Python image, shows the combined SBoMs, and points to using Buildah, Tern, ORA, cosign and OCI artifacts / SPDX JSON for reproducible supply-chain traceability.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:17What is an SBOM?
- 1:03The Case For Container SBOMS
- 3:45Do Saas providers need to generate SBOMS?
- 5:34Why not use Static Analyzers?
- 6:32Container Images have no room for metadata
- 8:45Building Transparency Into Container Builds
- 10:05A Starting point
- 19:38Filling in the Gaps - Artifact Management
- 21:02Filling in the Gaps - Reproducible builds
- 22:07Where to get involved
related talks
32mBack to the Drawing Board: Building Containers with SBoMs
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
37mDockerize Securely: SBOMs + Attestations + Bake
30mNo Joker in the Pack: SBoMs for Container Images
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
46mSCA for Containers: The Good, the Bad, and the Truth
05mGetting Started Getting Started with Containers- 46mSCA for Containers: The Good, the Bad, and the Truth