Image Security

Image Threat Model

Container images are a primary attack vector in Kubernetes. Compromised images bypass most runtime controls because the attack is baked in before the container ever starts.

Image Anatomy & Attack Surface

Understanding the OCI image specification reveals exactly where each attack type enters.

Image Identity: Tag vs Digest

Base Image Strategy

The base image determines your initial attack surface. Smaller base images have fewer packages to patch and a smaller CVE surface.

Multi-Stage Build Pattern

Multi-stage builds are the primary mechanism for separating build-time tools from the final image, preventing the leakage of build secrets and tools into production images.

Copy# Stage 1: Build (all build deps, secrets, tools)
FROM golang:1.22 AS builder

WORKDIR /app

# Dependency layer (cached unless go.mod/sum changes)
COPY go.mod go.sum ./
RUN go mod download

# Source code
COPY . .

# Build static binary — no CGO means no glibc dependency
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o /server ./cmd/server

# Stage 2: Final image — only the binary
FROM gcr.io/distroless/static-debian12:nonroot

# nonroot tag: runs as UID 65532 by default
COPY --from=builder /server /server

# Document the port (does not publish it)
EXPOSE 8080

# Use numeric UID to work with PodSecurityPolicy runAsNonRoot
USER 65532:65532

ENTRYPOINT ["/server"]

Copy# BuildKit secret mount — never appears in any layer
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    npm install --production

# Build with:
# docker buildx build --secret id=npmrc,src=.npmrc .

Vulnerability Scanning

Vulnerability scanners match image packages and libraries against CVE databases (NVD, OSV, GHSA). They are a necessary but not sufficient security control — zero-day vulnerabilities have no CVE.

Scanning Tools Comparison

Trivy Usage

Copy# Scan image — includes OS packages and language libs
trivy image nginx:1.25.3

# Scan with severity filter (fail CI on CRITICAL/HIGH)
trivy image --exit-code 1 --severity CRITICAL,HIGH nginx:1.25.3

# SBOM-first scan: generate CycloneDX SBOM then scan it
trivy image --format cyclonedx --output sbom.json nginx:1.25.3
trivy sbom sbom.json

# Scan in-cluster images (requires kubeconfig)
trivy k8s --report summary cluster

# Scan a specific namespace
trivy k8s --namespace production --report all

# Ignore unfixed vulnerabilities (useful for reducing noise)
trivy image --ignore-unfixed nginx:1.25.3

# Scan with .trivyignore for known-acceptable CVEs
trivy image --ignorefile .trivyignore nginx:1.25.3

CVSS Scoring and Triage

Trivy Operator — In-Cluster Continuous Scanning

Copy# Install Trivy Operator via Helm
helm repo add aqua https://aquasecurity.github.io/helm-charts/
helm install trivy-operator aqua/trivy-operator \
  --namespace trivy-system \
  --create-namespace \
  --set="trivy.ignoreUnfixed=true"

# Operator creates VulnerabilityReport CRDs per workload
kubectl get vulnerabilityreports -A
kubectl describe vulnerabilityreport replicaset-nginx-abc123 -n production

Copy# VulnerabilityReport CRD (auto-created by Trivy Operator)
apiVersion: aquasecurity.github.io/v1alpha1
kind: VulnerabilityReport
metadata:
  name: replicaset-nginx-abc123-nginx
  namespace: production
report:
  summary:
    criticalCount: 0
    highCount: 2
    mediumCount: 5
  vulnerabilities:
  - vulnerabilityID: CVE-2023-44487
    title: HTTP/2 Rapid Reset Attack
    severity: HIGH
    fixedVersion: 1.25.3
    resource: nginx

Registry Security

Registry Authentication

Copy# Create imagePullSecret for private registry
kubectl create secret docker-registry regcred \
  --docker-server=registry.example.com \
  --docker-username=myuser \
  --docker-password=mypassword \
  --docker-email=ops@example.com \
  --namespace production

# Reference in pod spec
spec:
  imagePullSecrets:
  - name: regcred
  containers:
  - image: registry.example.com/myapp:1.2.3

Copy# Attach imagePullSecret to ServiceAccount so all pods
# in the namespace automatically get it
apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  namespace: production
imagePullSecrets:
- name: regcred

imagePullPolicy

Registry Security Controls

Image Signing with Cosign

Cosign (part of the Sigstore project) enables cryptographic signing of container images, creating a verifiable link between an image digest and an identity that signed it.

Key-Based Signing

Copy# Generate key pair (store private key in Vault/KMS, not CI env var)
cosign generate-key-pair

# Sign image (after push to registry)
cosign sign --key cosign.key \
  registry.example.com/myapp@sha256:abc123...

# Sign with KMS key (Google Cloud KMS example)
cosign sign --key gcpkms://projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/cosign \
  registry.example.com/myapp@sha256:abc123...

# Verify image signature
cosign verify --key cosign.pub \
  registry.example.com/myapp@sha256:abc123...

# Verify outputs JSON with signer identity and timestamp

Keyless Signing (Sigstore)

Keyless signing uses ephemeral keys tied to OIDC identity (GitHub Actions, Google SA, etc.) and records signatures in the public Rekor transparency log. No long-lived private keys to manage or protect.

Copy# Keyless sign in GitHub Actions (OIDC token available automatically)
- name: Sign image
  run: |
    cosign sign \
      --yes \
      registry.example.com/myapp@${{ steps.build.outputs.digest }}
  env:
    COSIGN_EXPERIMENTAL: "1"  # Not needed from cosign v2.0+

# Keyless verify — check identity matches expected GitHub workflow
cosign verify \
  --certificate-identity-regexp "https://github.com/myorg/myrepo/.github/workflows/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  registry.example.com/myapp@sha256:abc123...

Attestations

Copy# Attach SBOM as attestation (CycloneDX format)
cosign attest \
  --key cosign.key \
  --type cyclonedx \
  --predicate sbom.cyclonedx.json \
  registry.example.com/myapp@sha256:abc123...

# Attach SLSA provenance as attestation
cosign attest \
  --key cosign.key \
  --type slsaprovenance \
  --predicate provenance.json \
  registry.example.com/myapp@sha256:abc123...

# Verify attestation
cosign verify-attestation \
  --key cosign.pub \
  --type cyclonedx \
  registry.example.com/myapp@sha256:abc123... | \
  jq .payload | base64 -d | jq .

SLSA Provenance

SLSA (Supply chain Levels for Software Artifacts, pronounced "salsa") is a framework of incrementally adoptable security levels for software supply chains, defined by Google and the OpenSSF.

SLSA Provenance with GitHub Actions

Copy# .github/workflows/release.yaml
jobs:
  build:
    permissions:
      id-token: write     # For OIDC / Sigstore
      contents: read
      packages: write     # For pushing to GHCR
    steps:
    - uses: actions/checkout@v4
    - name: Build and push
      id: build
      uses: docker/build-push-action@v5
      with:
        push: true
        tags: ghcr.io/myorg/myapp:${{ github.sha }}

  provenance:
    needs: [build]
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0
    with:
      image: ghcr.io/myorg/myapp
      digest: ${{ needs.build.outputs.digest }}
    permissions:
      id-token: write
      contents: read
      packages: write
      actions: read

Copy# Verify SLSA provenance
slsa-verifier verify-image \
  --source-uri github.com/myorg/myapp \
  --source-tag v1.2.3 \
  ghcr.io/myorg/myapp@sha256:abc123...

Policy Enforcement in Kubernetes

Kyverno verifyImages

Kyverno's verifyImages rule validates image signatures and attestations at admission time. It supports Cosign key-based, keyless, and attestation verification.

Copy# Kyverno ClusterPolicy: require signed images from trusted registry
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
spec:
  validationFailureAction: Enforce
  background: false   # Don't check existing pods
  rules:
  - name: verify-signature
    match:
      any:
      - resources:
          kinds: [Pod]
    verifyImages:
    - imageReferences:
      - "registry.example.com/*"
      attestors:
      - entries:
        - keys:
            publicKeys: |-
              -----BEGIN PUBLIC KEY-----
              MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
              -----END PUBLIC KEY-----
      mutateDigest: true   # Replace tag with verified digest
      verifyDigest: true   # Ensure image ref uses digest
      required: true

Copy# Kyverno verifyImages: keyless (Sigstore) verification
    verifyImages:
    - imageReferences:
      - "ghcr.io/myorg/*"
      attestors:
      - entries:
        - keyless:
            subject: "https://github.com/myorg/myrepo/.github/workflows/release.yaml@refs/heads/main"
            issuer: "https://token.actions.githubusercontent.com"
            rekor:
              url: https://rekor.sigstore.dev

Copy# Kyverno verifyImages: verify SBOM attestation exists
    verifyImages:
    - imageReferences:
      - "registry.example.com/*"
      attestations:
      - type: https://cyclonedx.org/bom
        attestors:
        - entries:
          - keys:
              publicKeys: "..."
        conditions:
        - all:
          - key: "{{ components | length(@) }}"
            operator: GreaterThan
            value: "0"

Registry Allow-List with Kyverno

Copy# Block images from untrusted registries
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
spec:
  validationFailureAction: Enforce
  rules:
  - name: validate-registries
    match:
      any:
      - resources:
          kinds: [Pod]
    validate:
      message: "Images must come from registry.example.com or gcr.io/distroless"
      pattern:
        spec:
          containers:
          - image: "registry.example.com/* | gcr.io/distroless/*"

OPA Gatekeeper: Digest Pinning Policy

Copy# ConstraintTemplate: require digest-pinned images
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredimagedigest
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredImageDigest
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8srequiredimagedigest

      violation[{"msg": msg}] {
        container := input.review.object.spec.containers[_]
        not contains(container.image, "@sha256:")
        msg := sprintf("Container '%v' image '%v' must use digest pinning (@sha256:...)", [container.name, container.image])
      }

      violation[{"msg": msg}] {
        container := input.review.object.spec.initContainers[_]
        not contains(container.image, "@sha256:")
        msg := sprintf("InitContainer '%v' image '%v' must use digest pinning", [container.name, container.image])
      }

ValidatingAdmissionPolicy (CEL): Registry Check

CopyapiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: check-image-registry
spec:
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: [v1]
      operations: [CREATE, UPDATE]
      resources: [pods]
  validations:
  - expression: >
      object.spec.containers.all(c,
        c.image.startsWith("registry.example.com/") ||
        c.image.startsWith("gcr.io/distroless/")
      )
    message: "Images must come from approved registries"
  - expression: >
      object.spec.containers.all(c,
        c.image.contains("@sha256:")
      )
    message: "Images must be pinned to a digest"

Runtime Image Security

Falco Rules for Image Anomalies

Falco detects runtime behavior that indicates a compromised or malicious image. Crucially, Falco detects but does not prevent — pair it with admission controls for prevention.

Copy# Falco rule: detect container running as root
- rule: Container Running as Root
  desc: Detect containers running as root user
  condition: >
    container and
    proc.vpid=1 and
    user.uid=0 and
    not container.image.repository in (trusted_root_images)
  output: >
    Container running as root (user=%user.name image=%container.image.repository
    container=%container.name pod=%k8s.pod.name ns=%k8s.ns.name)
  priority: WARNING

# Falco rule: detect unexpected network connection from container
- rule: Unexpected Outbound Connection
  desc: Detect outbound network connections to unusual destinations
  condition: >
    outbound and
    container and
    not fd.sport in (allowed_outbound_ports) and
    not fd.sip in (allowed_outbound_ips)
  output: >
    Unexpected outbound connection (image=%container.image.repository
    connection=%fd.name pod=%k8s.pod.name)
  priority: CRITICAL

# Falco rule: detect binary execution in container
- rule: Unexpected Process in Container
  desc: Detect execution of binaries not expected in container
  condition: >
    spawned_process and
    container and
    not proc.name in (allowed_processes) and
    not proc.pname in (allowed_parent_processes)
  output: >
    Unexpected process (proc=%proc.name pproc=%proc.pname
    image=%container.image.repository pod=%k8s.pod.name)
  priority: ERROR

Image Pull Verification Workflow

Dockerfile Hardening

Complete Hardened Dockerfile

Copy###############################################################
# Stage 1: Dependency download (separate for better caching)
###############################################################
FROM node:20-alpine3.19 AS deps

WORKDIR /app

# Copy only manifests first — layer cache: only invalidated when deps change
COPY package.json package-lock.json ./
RUN npm ci --only=production --ignore-scripts

###############################################################
# Stage 2: Application build
###############################################################
FROM node:20-alpine3.19 AS build

WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci                          # include devDeps for build
COPY . .
RUN npm run build

###############################################################
# Stage 3: Production image
###############################################################
FROM node:20-alpine3.19

# Upgrade OS packages to get latest CVE fixes
RUN apk update && apk upgrade --no-cache && rm -rf /var/cache/apk/*

# Create non-root user with fixed UID (important for runAsNonRoot + runAsUser)
RUN addgroup -g 10001 -S appgroup && \
    adduser  -u 10001 -S appuser -G appgroup

WORKDIR /app

# Copy artifacts from build stages (not source code or devDeps)
COPY --from=deps   --chown=appuser:appgroup /app/node_modules ./node_modules
COPY --from=build  --chown=appuser:appgroup /app/dist         ./dist
COPY               --chown=appuser:appgroup package.json      .

# Drop to non-root user
USER 10001:10001

# Document (do not publish) the application port
EXPOSE 3000

# Use exec form (not shell form) to ensure signals propagate correctly
ENTRYPOINT ["node", "dist/server.js"]

Dockerfile Anti-Patterns

.dockerignore

Copy# .dockerignore — always include this file
.git
.gitignore
*.md
.env
.env.*
*.key
*.pem
*.cert
*.crt
node_modules
dist
coverage
.DS_Store
Dockerfile*
docker-compose*
.github
tests
__tests__
*.test.ts
*.spec.ts

Metrics, Alerts & Runbooks

Key Metrics

Alerts

Copy# Alert: Critical CVE in running workload
- alert: CriticalCVEInRunningWorkload
  expr: sum by (namespace, workload, image) (trivy_vulnerability_id{severity="CRITICAL"}) > 0
  for: 5m
  annotations:
    summary: "Critical CVE in {{ $labels.workload }} ({{ $labels.namespace }})"

# Alert: Image from untrusted registry blocked
- alert: UntrustedRegistryBlocked
  expr: increase(kyverno_policy_results_total{policy="restrict-image-registries",result="fail"}[5m]) > 0
  annotations:
    summary: "Attempt to deploy image from untrusted registry"

# Alert: Signature verification failures spike
- alert: ImageSignatureVerificationFailure
  expr: increase(kyverno_policy_results_total{policy="verify-image-signatures",result="fail"}[5m]) > 3
  annotations:
    summary: "Multiple image signature verification failures — possible supply chain attack"

# Alert: Falco runtime anomaly
- alert: FalcoRuntimeAnomaly
  expr: increase(falco_events_total{priority=~"CRITICAL|ERROR"}[5m]) > 0
  annotations:
    summary: "Falco detected runtime anomaly: {{ $labels.rule }}"

Runbooks

Best Practices