Скачать или смотреть Integrity of Docker Images - Signatures, Verification and a Tool for k8s (Philipp Belitz)

In modern software development, the introduction of containers and their orchestration have led to faster delivery, more flexible deployment and higher scalability and stability of applications. These packaged applications are distributed via images that serve as immutable starting snapshots for containers in the runtime environments.

Consequently, ensuring integrity and authenticity of images is of critical importance for the secure deployment of software. This can be achieved by adding signatures to guarantee authenticated and unaltered code. However, practical implementation of image signing and verification has remained a major challenge. This talk dives into current solutions and shortcomings for the two most popular containerization and orchestration engines, Docker and Kubernetes. It will touch on Docker Content Trust (DCT), Notary and The Update Framework (TUF) used for Docker image signing and introduce Connaisseur, a signature verification tool for Kubernetes.

https://github.com/sse-secure-systems...

  / container-image-signatures-in-kubernetes