container image security Shipped
What this lens looks for
Treat a container image as a deployable supply-chain artifact. Scan + gate: scan in CI before any registry push (Trivy/Grype/Snyk), gate on exploitability (fail on CISA KEV, SHOULD fail on high EPSS — not every high-CVSS), never ship unaddressed KEV, re-scan published images on a schedule, suppressions carry justification + expiry. Pin + slim: pin base by immutable digest (FROM image@sha256:) not latest, prefer distroless/alpine/wolfi/scratch, multi-stage builds keep build tools out, rebuild on a cadence. Sign + provenance: cosign-sign + verify at deploy, emit SBOM (SPDX/CycloneDX), SLSA attestations (admission enforcement is YAGNI-until-needed). Harden runtime: non-root USER, no baked secrets (ENV/build args/copied files), read-only rootfs + dropped capabilities, workload identity over long-lived creds.
What its verifier checks
Image scanned in CI before any registry push; build fails on CISA KEV findings and on high EPSS (not blanket high-CVSS), and no image ships with unaddressed KEV vulns; published images re-scanned on a schedule; every suppression carries a justification and an expiry/review date (no permanent blanket ignores); base pinned by sha256: digest (no latest); minimal/distroless base + multi-stage build (no compilers/dev deps in the final image); image cosign-signed and signature verified at deploy/admission; SBOM (SPDX or CycloneDX) emitted; runtime runs as a non-root USER (not UID 0); no secrets baked into any layer (ENV/build args/copied files) — secret-scanned to confirm; read-only root filesystem and dropped capabilities where the workload allows; no long-lived registry/cloud credentials in the image (workload identity / short-lived tokens).