What is Supply Chain Security in containers?

Question

Accepted Answer

**Supply Chain Security** — protecting the entire process: from writing code to running containers.

**Defense layers:**

**1. SBOM (Software Bill of Materials):**
```bash
# Generate SBOM
syft myapp:latest -o spdx-json > sbom.json
trivy image --format spdx-json myapp:latest > sbom.json

# Check SBOM
trivy sbom sbom.json
```

**2. Container Image Signing (Cosign):**
```bash
cosign sign ghcr.io/myorg/myapp:latest
cosign verify \
  --certificate-identity=ci@myorg.com \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  ghcr.io/myorg/myapp:latest
```

**3. Admission Control (Kyverno):**
```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-and-scan
spec:
  validationFailureAction: Enforce
  rules:
    - name: verify-image
      verifyImages:
        - imageReferences: ["ghcr.io/myorg/*"]
          attestors:
            - entries:
                - keys:
                    publicKeys: "-----BEGIN PUBLIC KEY-----..."
    - name: check-no-latest
      match:
        any:
          - resources:
              kinds: ["Pod"]
      validate:
        message: "Using :latest is prohibited"
        pattern:
          spec:
            containers:
              - image: "!*:latest"
```

**4. CI/CD Security:**
- dependency pinning (lock files).
- SAST/DAST scanning.
- Secret scanning.
- SLSA provenance.

**Chain:** Code → Scan → Sign → SBOM → Verify → Deploy.

DevOps: What is Supply Chain Security in containers?