Marko Filipovic’s Post

Most Docker tutorials stop at docker run. That’s exactly where production problems begin. I learned this the hard way. A base image CVE sitting in production, not caught by the pipeline, flagged hours later in an audit. The image had been running fine. The vulnerability hadn’t. I just didn’t know. That experience changed how I think about container delivery. It’s not enough to build an image that works. It needs to be minimal, verified, signed, and scanned, before it ever touches a registry. So I built a reference project that codifies exactly that. Here’s what I changed after that audit: Distroless final image. No shell, no package manager, ~4MB. The base image CVE that got us? No longer possible. There’s almost nothing left to exploit. Trivy scans every image before push. The pipeline fails on HIGH/CRITICAL, not a Slack notification you’ll read tomorrow. Not advisory. A hard stop. SBOM generated at build time. Image signed with cosign keyless signing. No private key to manage, signature tied to the GitHub Actions OIDC identity. You can prove exactly what was built and who built it. The CI/CD pipeline does two different things depending on context: On PRs: source scan, build amd64 locally, scan the loaded image. No registry push. No packages: write on untrusted code. On main/tags: multi-arch build, push, scan the exact digest (not the tag, tags are mutable), sign. One deliberate trade-off I documented: Release runs two builds, validation and publish. Slower. But the permission separation is clean, and clean pipelines don’t surprise you at 2am. Every decision has an ADR. Every operational scenario has a runbook entry. Because the person debugging this might be me. → https://lnkd.in/dUMiQCta If you’re building container delivery pipelines, what does your image scanning gate look like? Before push, after push, or both? #Docker #DevOps #CICD #PlatformEngineering #Security #Kubernetes

Great write-up, thanks for sharing! Curious how you prefer handling post-release CVEs. Do you run scheduled re-scans (CI cron/k8s crons/bots), or rely on registry/GitHub alerts, or sth completely different?

Nabin Sademba

father | information security enthusiast | Cloud Infrastructure Engineer

2w

Thank you for the good deed, it will pay you back someday.

Like
Reply
See more comments

To view or add a comment, sign in

Explore content categories