Path 06 · learning path
Where compromise enters between source and a running container, and the control at each link: an SBOM of a real image with Syft, findings and fixes with Grype, signing and verification by digest with Cosign, and an SBOM attached as an attestation. Container Security asks what is in the image; this path asks whether it is the image you built.
Each part names what it needs. Nothing has to be installed before part 1.
The path
Each part states what it assumes from the previous one, so you can also jump in where your setup already is.
The delivery chain from source through dependencies, build, artifact, image, registry and deployment; where each link can be compromised; and the control for each, from lockfiles and SBOMs to signing by digest.
Run Syft from its container against a small Node.js image, read the CycloneDX output package by package, see where each one came from, learn what an SBOM does not prove, and store it next to the artifact.
Grype against the SBOM from part 2: 183 matches read by severity, ecosystem and fix state; two Dockerfile changes that take it to 3; exit-code behaviour for CI; and how to triage what remains.
Cosign with a key pair against a local registry: why the digest is the identity; signing and verifying; a moved tag failing verification while the digest passes; keyless signing as configuration; where the check goes.
Turn the SBOM from part 2 into a Cosign attestation bound to the image digest, verify it and read the predicate back, list what hangs off an image with cosign tree, and see what SLSA build provenance adds.
Practise
Produce CycloneDX and SPDX bills of materials for a container image without a Docker socket, scan the SBOM with Grype, gate on fixable findings only, and see why the SBOM is worth keeping after the release.
Build a deliberately weak image, scan it with Trivy, and rebuild it until the gate for fixable HIGH and CRITICAL findings passes: current base, non-root user, patched packages, no pip in the runtime image.
Toolchain
Generates SBOMs (CycloneDX, SPDX) from images, directories and archives.
Vulnerability scanner for images, filesystems and SBOMs produced by Syft.
Signs and verifies container images, SBOMs and attestations.
All-in-one scanner for container images, filesystems, IaC, Kubernetes and SBOMs.
After the last part
One path picks up where this one stops. It is a suggestion, not a requirement.
One contract, four components: environments from Git, a golden CI path, guardrails through GitOps, visibility.