Image Signing
ELI5 — The Vibe Check
Image Signing is like putting a wax seal on your Docker images. You sign the image after building it, and your cluster verifies the signature before running it. No valid signature? No deployment. It proves the image came from your CI/CD and hasn't been tampered with.
Real Talk
Container image signing uses cryptographic signatures to verify image integrity and provenance. Cosign (part of Sigstore) signs images with keyless (OIDC-based) or key-based signatures stored in OCI registries. Kubernetes admission controllers (Kyverno, OPA) can enforce signature verification.
Show Me The Code
# Sign with cosign (keyless)
cosign sign myregistry.io/myapp:v1.0
# Verify
cosign verify myregistry.io/myapp:v1.0
When You'll Hear This
"Our Kubernetes cluster rejects any image without a valid cosign signature." / "Keyless signing with Sigstore means we don't manage signing keys."
Related Terms
Container Scanning
Container Scanning checks your Docker images for known vulnerabilities in OS packages, libraries, and misconfigurations.
Sigstore
Sigstore makes signing software as easy as logging in with your Google account. No managing PGP keys, no key rotation headaches.
SLSA
SLSA (pronounced 'salsa') is a framework with levels (1-4) that measure how secure your software supply chain is. Level 1: you have some build process.
Supply Chain Security
Supply Chain Security protects the entire path from code to production — dependencies, build systems, registries, everything.