Improving security by signing container images
As we mentioned in the previous section, a digest is the only way we can validate which image we are really using. In this section, we will review how we can improve this by signing images. This will really ensure we use the right images, as we can check the signature and verify the ownership of every image.
We are going to analyze and learn about the Docker methodology used to sign images, but there are other methods available. We will use Cosign in the Labs section, which seems easier and integrates very well with the Kubernetes container orchestrator.
Docker created Docker Content Trust some years ago to integrate digital signatures in the container images management workflow and associate signatures with image tags. We will be able to have repositories with signed and unsigned images, for example, for local tests before moving on to a new stage. You, as a developer, create your images and decide which ones should be signed.
...
