Lesson 5.36: Verifying container image signatures
A tag like payments:3.2 is just a name anyone with push access can point at any image. Signing images in the pipeline and verifying the signature before deployment ties what runs to what your build produced. In the lab you verify Northwind's payment images with cosign and the company's public key, catch a tag that was pushed without a signature, learn why a vendor image needs the vendor's key, and pin the verified image by digest so the tag can't move under you.
16 min
You will learn to
- Explain why tags can't be trusted on their own
- Verify an image signature with cosign and a public key
- Read cosign's failures (no signatures, wrong key)
- Find the digest a signature covers
- Deploy by digest
Key terms
- cosign
- Sigstore's tool to sign and verify container images; signatures are stored in the registry next to the image.
- Digest
- The SHA-256 of an image manifest; identifies exactly one image.
- Tag
- A movable name for an image (payments:3.1).
- Transparency log
- Rekor: a public append-only log where signing events are recorded.
- Admission policy
- A cluster rule that refuses pods whose images fail verification.
← Capstone 1: a forensic timeline from first login to persistence · All lessons · Discovering hosts and services with nmap, within scope →