What problem does it solve?
Container registries often accumulate unscanned, unsigned, or mutable images that introduce supply chain risk. This Skill guides you through scanning images with Trivy and Grype, signing them with Cosign, generating SBOMs with Syft, and enforcing registry-level controls so vulnerable or unsigned images never reach production.
Core Features & Use Cases
- Vulnerability Scanning: Scan images with Trivy and Grype, fail CI pipelines on CRITICAL findings, and generate SBOMs in SPDX or CycloneDX formats.
- Image Signing & Attestation: Sign images with Cosign using key-based or Sigstore keyless workflows, attach SBOMs and scan results as attestations, and verify signatures before deployment.
- Registry Hardening: Configure ECR, ACR, and GCR controls including scan-on-push, tag immutability, lifecycle policies, and continuous rescanning of deployed digests.
- Use Case: A security team needs a promotion pipeline where images are scanned, signed, and only promoted to the production registry after passing CRITICAL vulnerability gates, with Kyverno verifying signatures at admission time.
Quick Start
Set up a CI/CD pipeline that scans my container image with Trivy, blocks CRITICAL vulnerabilities, signs it with Cosign, and pushes it to ECR with tag immutability enabled.
