Image Scanning Pipeline

The scanner unpacks the OCI image manifest and inspects each filesystem layer sequentially. It cross-references installed OS packages, language-specific libraries (pip, npm, maven), and binary artifacts against multiple CVE databases (NVD, GitHub Advisory, distro-specific trackers). This granular approach pinpoints the exact layer introducing a vulnerability, enabling precise remediation. Distroless images reduce noise by eliminating unused OS utilities.

Scan results are evaluated against a codified Open Policy Agent (OPA) or custom YAML policy defining severity thresholds (CRITICAL, HIGH), allowed CVEs, and required approvals. If the image fails, the pipeline halts before the image is pushed to the registry. This enforces a 'shift-left' security posture, preventing vulnerable artifacts from ever reaching a production namespace or being pulled by a Kubernetes admission controller.

A critical output is the automated generation of a Software Bill of Materials (SBOM) in SPDX or CycloneDX format. The pipeline then uses a tool like Cosign to cryptographically sign the SBOM, creating a verifiable image attestation. This signed metadata is stored alongside the image in the OCI registry, providing tamper-proof supply chain transparency for auditors and downstream consumers.

Beyond CVEs, the pipeline scans for hardcoded secrets (API keys, tokens, private keys) using entropy detection and regex pattern matching. Advanced configurations also integrate malware scanners (e.g., ClamAV) to detect trojans or cryptominers embedded in image layers. This prevents credential leakage and ensures the image is free of malicious code before it is promoted to a golden image repository.

Scan results are pushed back to the container registry as an OCI artifact or stored in a dedicated database with a reference to the image digest. This allows the registry UI (e.g., Harbor) to display vulnerability status directly. It enables retention policies to automatically purge old, critically vulnerable images and supports admission controllers that query the registry's API for real-time deployment decisions.

The pipeline is not a one-time gate. The registry continuously monitors the National Vulnerability Database (NVD) and other feeds for newly published CVEs. When a new critical vulnerability is disclosed, the system automatically rescans all existing images matching the affected component. Notifications are triggered, and binary authorization systems can be updated to revoke the execution privileges of now-vulnerable images.

A unique, content-addressable SHA256 hash that immutably identifies a specific container image manifest or layer. Scanning pipelines use digests to ensure that the artifact being scanned is cryptographically identical to the one deployed.

• Enables deterministic vulnerability tracking
• Prevents TOCTOU (time-of-check/time-of-use) attacks
• Referenced as image@sha256:abc123...

A Kubernetes-native plugin that intercepts API requests and can validate or mutate objects before they are persisted. In the context of scanning, an admission controller enforces that only images passing a vulnerability policy are allowed to run.

• Examples: OPA Gatekeeper, Kyverno
• Validates scan results stored in the registry
• Blocks deployment if critical CVEs exceed threshold

A cryptographically signed, verifiable statement about a container image, such as an SBOM or a vulnerability scan result, stored alongside the image in the registry. Attestations create an immutable audit trail linking the scan to the exact artifact.

• Signed using Cosign or Notary
• Enables policy decisions based on verified metadata
• Critical for SLSA compliance

A deploy-time security control that enforces strict signature validation, ensuring only container images signed by trusted authorities during the build process can be deployed. It acts as the final gate after the scanning pipeline has completed.

• Integrates with Sigstore for keyless signing
• Enforces content trust policies
• Prevents deployment of unsigned or tampered images