SECURE YOUR CONTAINER IMAGES WITH SIGNATURE VERIFICATION

Summary from the TLDR InfoSec newsletter

Signature verification and image signing enhance supply chain resiliency by ensuring image integrity. DataDog created a signing service for signing images to facilitate adoption across varied CI/CD processes that stored signatures in an OCI-compliant registry and verified these signatures. It managed signature verification during image pulls as a containerd plugin rather than through an admission webhook to prevent cluster-level dependencies in the Kubernetes control plane's hot path.