Course · Training · Workshop
Container Supply Chain Security: The Practitioner's Journey
Step-by-step securing of the container supply chain: From chaos to cryptographically verifiable trust in four practical levels.
This two-day workshop guides developers through securing the container supply chain – not with theoretical frameworks, but through a hands-on journey: from an uncontrolled status quo through transparency and control to cryptographically verifiable trust. Each level builds on the previous one and delivers immediate, usable value.
Trainers
What participants say
These customers booked courses in the same topic cluster.More customers →
Content
The workshop follows an incremental approach, inspired by the Agile Manifesto: Working Protection over Comprehensive Documentation, Incremental Hardening over Big-Bang Security, Developer Experience over Security Theater, Automated Verification over Manual Audits.
Participants progress through four levels, each building on the previous one. After each level, they have a functional setup with immediate value. The workshop addresses real attack vectors of the software supply chain: compromised dependencies, manipulated build pipelines, insecure package repositories.
Day 1: See, Understand, Control
– Level 0 to Level 1: Visibility (“I see what happens”):
- Threat landscape: SLSA vectors and real-world attacks
- Toolbox overview: Harbor, Kyverno, Cosign, Slim, Copacetic
- Harbor basics: Pull/push, project structure, vulnerability reports
- Consuming 3rd party images: Harbor proxy cache for DockerHub/GHCR
- Image insights with Slim: xray and appbom on 3rd party images
- Outcome: Own and 3rd party images flow through central registry, vulnerabilities are visible
– Level 1 to Level 2: Control (“I determine what is allowed”):
- 3rd party risks: Typosquatting, malicious images, abandoned packages
- Kyverno registry allowlist: Only Harbor proxy allowed, direct pull blocked
- Verifying 3rd party signatures: cosign verify on official images
- Generating SBOMs: Syft locally and in CI
- Consuming upstream SBOMs: Find and read upstream SBOMs
- SBOM policy: Kyverno blocks images without SBOM
- Outcome: Direct pulls blocked, only signed/known upstreams allowed, SBOM requirement enforced
Day 2: Prove, Patch, Respond
– Level 2 to Level 3: Trust (“I can prove it”):
- Signing and attestations: Cosign, keyless, SLSA provenance
- Signing images: Cosign keyless with GitHub/GitLab OIDC
- Verifying signatures: cosign verify, Rekor transparency log
- Kyverno signature policy: Only signed images deploy
- SLSA provenance: Generate and verify attestations
- Outcome: Every image is signed, build provenance is attested
– Level 3 to Level 4: Resilience (“I can respond”):
- Cyber Resilience Act: Requirements, timeline, impact
- Patching strategies: Rebuild vs. patch-in-place
- Copacetic: Patch vulnerable base image and re-sign
- Outlook: SBoB and runtime with Falco
- Full pipeline: Build, scan, patch, sign, SBOM, deploy
- Checklist and next steps
- Outcome: Independent CVE response, complete pipeline operational
You will not only get to know these concepts, but also implement them in practice.
The actual course content may differ from the above depending on the trainer, delivery, duration and the composition of participants.
Request this course in-house
Request a public date
No suitable public date? Register without obligation — once there is enough interest we schedule a new public date and let you know first.
More about Container Supply Chain Security
Container Supply Chain Security deals with securing all components and processes in the container-based software delivery pipeline. From development through build pipelines to production, trust, transparency, and traceability must be ensured. The SLSA Framework provides a structured approach to implementing supply chain security at different levels.Further resources:
History
Container Supply Chain Security gained significant importance after high-profile attacks like SolarWinds (2020) and the compromise of container registries. These incidents demonstrated how attackers could compromise trusted software components.
In response, organizations like Google, the Linux Foundation, and the CNCF developed frameworks and tools to improve supply chain security. The SLSA Framework, Sigstore (with Cosign and Rekor), and Harbor emerged from the need to create standardized, scalable solutions. Dan Lorenc and the Sigstore team revolutionized code signing with keyless signing.
Today, container supply chain security is a central component of modern DevSecOps practices and is being further driven by regulations like the EU Cyber Resilience Act. Tools like Kyverno, Copacetic, and Slim enable developers to take security responsibility without compromising developer experience. The focus is shifting from manual audits to automated verification and from big-bang security to incremental hardening.