Improving the Security of Containerized Workloads using Transparency and Traceability Services

2026-08-01

AI Summary

This work addresses the vulnerability of containerized CI/CD pipelines to supply chain attacks, where compromise at a single stage can lead to widespread distribution of malicious images. To mitigate this risk, the authors propose a verifiable container image distribution architecture that enforces integrity and compliance during admission control through policy-as-code mechanisms. The design leverages identity-bound one-time signing keys, an append-only transparency log, and verifiable inclusion proofs to ensure that only validated and compliant artifacts are deployed. Integrated with GitHub Actions and GitLab Runners, the prototype implementation demonstrates effective defense against representative supply chain attacks while maintaining practical deployability.

Abstract

Containerized workloads are commonly built via CI/CD pipelines, stored in registries, and executed across heterogeneous infrastructures, including cloud and edge environments. A single compromised build step or credential can turn routine automation into large-scale distribution of malicious artifacts, motivating integrity, transparency, and enforceable deployment-time checks. In this paper, we present an architecture for verifiable container image distribution that addresses key-management challenges and enables policy-enforced admission-time verification. A transparency service generates one-time signing keys bound to authenticated identities, records signing events in an append-only transparency registry, and returns cryptographically verifiable proofs of inclusion. These proofs and identity attributes are attached to image metadata and evaluated by policy-as-code at admission time, so only compliant artifacts are deployed. We implement a proof-of-concept integrated with GitHub Actions and GitLab Runners and evaluate how the resulting pipeline mitigates common supply-chain attacks under a realistic threat model.

Problem

• container security
• software supply chain
• transparency
• traceability
• integrity

Innovation

• transparency service
• verifiable container image
• policy-enforced admission
• one-time signing keys
• supply-chain security