In December 2020, attackers compromised SolarWinds' build system and injected malicious code into a software update that was distributed to 18,000 organizations, including the U.S. Treasury and Department of Homeland Security. The attackers didn't hack into those agencies directly—they poisoned the software supply chain, trusting that victims would install the update themselves.
Your Task API container image pulls from base images, installs packages, and bundles dependencies. Each layer introduces potential vulnerabilities. Without scanning, you deploy unknown risks into production. Without provenance verification, you trust that images are what they claim to be.
In May 2024, the XZ Utils backdoor (CVE-2024-3094) demonstrated how attackers can compromise widely-used libraries through patient, multi-year social engineering. The malicious code was caught just days before making it into major Linux distributions. This lesson teaches you to build automated defenses against these supply chain attacks.
Trivy is an open-source vulnerability scanner that analyzes container images, filesystems, and IaC configurations. Aqua Security maintains it, and it's the most widely adopted scanner in the Kubernetes ecosystem.
Install on macOS:
Output:
Install on Linux:
Output:
Verify installation:
Output:
Run a basic vulnerability scan against your Task API image:
Output:
Understanding the output:
Not all vulnerabilities require immediate action. Prioritize based on severity and context:
Filter by severity:
Output:
Decision framework for CRITICAL vulnerabilities:
Integrate Trivy into your GitHub Actions workflow to prevent vulnerable images from reaching production.
Create .github/workflows/security-scan.yml:
What this workflow does:
Output when CRITICAL vulnerability detected:
The build fails, preventing deployment of the vulnerable image.
An SBOM lists every component in your container image—base OS packages, language dependencies, and application libraries. Compliance frameworks (SOC2, FedRAMP) increasingly require SBOMs for software audit trails.
Generate SBOM in SPDX format:
Output:
Inspect the SBOM:
Output:
Your Task API image contains 247 distinct packages. When a new CVE is announced, you can search your SBOM to determine if you're affected:
Output:
SBOM formats:
For compliance, generate both SPDX and CycloneDX:
Trivy detects vulnerabilities, but doesn't verify that an image is authentic. Cosign, part of the Sigstore project, signs container images cryptographically so you can verify provenance before deployment.
Why signing matters:
Sign an image (keyless with OIDC):
Output:
Cosign uses keyless signing by default, authenticating via OIDC (GitHub, Google, Microsoft). No private keys to manage.
Verify before deployment:
Output:
Production recommendation: Use Kubernetes admission controllers (Kyverno, Gatekeeper) to enforce signature verification at deploy time. Without enforcement, signing is just documentation.
Container tags are mutable—task-api:latest can point to different images over time. Attackers who compromise a registry can push malicious images using the same tag.
The problem with tags:
The solution: digest pinning:
Get the digest for your image:
Output:
Best practice workflow:
Before promoting your Task API image to production, verify:
Test your cloud-security skill against what you learned:
If any answers are "no," update your skill with the patterns from this lesson.
Test your understanding of image scanning and supply chain security.
Prompt 1:
What you're learning: Whether you understand CI/CD integration with Trivy. Key elements: exit-code: '1', severity: 'CRITICAL,HIGH', SARIF format upload. The workflow should stop deployment on security issues, not just report them.
Prompt 2:
What you're learning: Practical vulnerability management. Strategies include: Alpine/Distroless base images (fewer packages = fewer CVEs), multi-stage builds (dev dependencies excluded from final image), filtering by severity and fixability, ignoring vulnerabilities in packages your code doesn't use.
Prompt 3:
What you're learning: How to communicate security concepts to business stakeholders. Scanning is like checking a package for damage before accepting delivery. Signing is like a tamper-evident seal proving the package wasn't opened in transit. SOC2 requires evidence of both vulnerability management (scanning) and change management (signing provides audit trail).
Trivy and other scanners only detect known vulnerabilities with assigned CVEs. Zero-day vulnerabilities won't appear in scan results. Defense in depth—NetworkPolicies, Pod Security Standards, RBAC—provides protection even when vulnerabilities exist in your code or dependencies. Scanning is essential but not sufficient.