Virtualization · Cluster
Image Supply Chain
Build provenance and registry trust.
- 01 Content Digests and Why an Image Tag Is Not an Identity How a digest names image bytes rather than a name, what the verification chain from tag to unpacked filesystem actually checks, and where that chain is weaker than it looks.
- 02 How an OCI Manifest and Index Name Their Layers The descriptor graph behind a single image reference, how platform selection picks one manifest out of an index, and the failure cases in the matching rules.
- 03 The Registry Pull Path From Manifest to Blob The HTTP exchanges a client performs to turn a reference into a local image, including token authentication, blob redirects, range requests, and where each step can fail.
- 04 Layer Cache Keys and What Makes a Build Reproducible Why two builds of the same source produce different layer digests, which inputs a build cache actually keys on, and how instruction ordering changes both reuse and image size.
- 05 What an Image Signature Covers and What It Leaves Out How a signature envelope binds a signing key to a payload digest, why the payload is usually not the image, and the payload types that close different parts of the gap.
- 06 Provenance Statements and the Subject Digest How a build attestation names the artifact it describes, what the subject field binds, and why a valid attestation is not the same as an attestation about the image being deployed.
- 07 Referrers, Attachments, and the Artifact Graph How a registry indexes artifacts by the digest they describe, why the fallback naming convention is spoofable, and how a verifier discovers signatures and SBOMs without being told where to look.
- 08 Admission-Time Verification and Digest Pinning What a cluster can check between a pod specification and an image pull, why the kubelet is the wrong place for that check, and how digest pinning interacts with tag resolution order.
- 09 Pull-Through Caches and Where the Trust Anchor Sits How a caching proxy changes the set of parties that can influence an image, why the cache must not also serve the keys used to verify it, and what staleness does to revocation.
- 10 Verifying Provenance by Rebuilding What an independent rebuild proves, which nondeterministic packaging details decide whether it succeeds, and how to compare artifacts layer by layer rather than by image digest.