Who's Verifying Your Signatures? Approaching Private Container Image Signing
summary
Datadog signs private images after finding public tools often miss internal needs: evaluated Notary v1/V2, Grafeas, TUF and Sigstore/cosign and chose a custom signer API + Vault using Ed25519 keys and a simple OCI envelope pushed into the registry so signatures replicate with images; verification runs in a containerd node-level verification plugin because cosign verification round trips add seconds of latency; machines carry baked public keys, resigned only the images actually running in production across hundreds of thousands of pods and it works so far.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:20About Datadog
- 1:29Agenda
- 2:02Why
- 4:29Tools
- 5:24Survey Tools
- 5:43Notary V1
- 8:05Graphase
- 11:09Notary V2
- 12:56Update Framework
- 14:20Cosine
- 16:51How are we using Datadog
- 18:56Requirements
- 22:41Demo
- 24:53Conclusion
related talks
42mDid you sign this (image)?
13mIncreasing trust in software supply chain w/ container image signing
32mNotary v2: Redesigning the Secure Supply Chain for Containers
31mSign, Attest, and Verify! A Practical Guide for Software Supply...
30mNotary v2: Supply Chain Security for Containers
31mSigned, Sealed, Delivered - Sign and Verify All the Things
37mNotary: State Of Development
25mProving Trust: Signed Supply Chains and Verifiable Deployments at the Edge