Image Security

The Image Supply Chain

Image security spans more than a scanner badge:

• Provenance — who built it, from which commit, in which pipeline (SLSA attestations, cosign signatures).
• Vulnerability posture — minimal base images, patch cadence, CI scan gates before push.
• Distribution — private registries, pull secrets, admission restricting approved sources.
• Runtime hygiene — non-root user, read-only filesystems, no unnecessary shells.

Kubernetes itself enforces parts of this: imagePullPolicy controls tag reuse, imagePullSecrets gates private pulls, and digest references (repo/app@sha256:...) make an image immutable — a tag can be repointed, a digest cannot.

Hardened Manifests

spec:
  imagePullSecrets:
  - { name: regcred }
  containers:
  - name: app
    image: registry.example.com/app@sha256:2c1f9a...
    imagePullPolicy: IfNotPresent
    securityContext:
      runAsNonRoot: true
      runAsUser: 10001
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }

A digest-pinned image makes IfNotPresent safe, since the reference cannot drift. readOnlyRootFilesystem forces temp state into emptyDir mounts.

Pair manifests with admission policy rejecting :latest, unsigned images, or unknown registries. Audit drift with kubectl get pods -A -o jsonpath='{.items[*].spec.containers[*].image}' and compare digests against the registry — not tags.

Pitfalls and Interview Angles

Pitfall 1 — trusting tags in production. Tags move: an accidental overwrite or compromise redirects your deploy while your manifest looks unchanged. Resolve digests in CI and commit those.

Pitfall 2 — scanning once at build. New CVEs appear after release; re-scan running images on a schedule, drive rebuilds from findings, and block criticals at admission — a green build badge proves a moment, not a state.

Interview-ready: walk your pipeline — minimal base, scan gate, sign with cosign, store digest, admit only approved sources — and answer "how do you know what runs in production" by comparing cluster digests to the registry rather than trusting tag names.