docker-security

You can audit Docker containers by running static analysis on Dockerfiles with Hadolint, scanning images for vulnerabilities with Trivy, and verifying supply-chain signatures with Cosign to enforce secure defaults.

Docker supply-chain integrity verification validates image signatures and attestations using Cosign. You need it in CI/CD pipelines before deployment to ensure images have not been tampered with and originate from trusted sources.

To scan Docker images for vulnerabilities in CI/CD, integrate Trivy to assess image layers and generate SBOM attestations, blocking deployments if critical security issues are detected during the pipeline execution.

Yes, you need Hadolint, Trivy, Cosign, Docker, and jq installed locally or in your pipeline environment, as these tools provide the static analysis, vulnerability scanning, and signature validation required for the audit.

The best way to harden Dockerfiles is using Hadolint for static analysis to enforce secure defaults, combined with Trivy runtime vulnerability scanning to identify and minimize the container attack surface.

Yes, you can validate SBOM attestations and verify signatures locally by running the docker-security-full-audit.sh script, which applies Cosign to check supply-chain integrity during local development.