About
In this module of the Docker Security learning path, you shift the focus from the running container back to the build and delivery pipeline. A hardened runtime configuration is only part of the story. Most real-world compromises enter through the supply chain: a base image with unpatched CVEs, a Dockerfile that leaks credentials into image layers, an unsigned image that an attacker replaces in the registry, or an SBOM that nobody reviewed before deploying. You work through four shift-left controls on a nested Docker lab host that cover secure delivery and supply chain. First, you use Trivy and hadolint to build a scan gate that rejects images with critical vulnerabilities or insecure Dockerfile patterns. Second, you generate and review a Software Bill of Materials (SBOM) with Syft so you can trace every package that ships in a production image. Third, you use Cosign to sign an image with a local key pair and verify that signature before deployment. Fourth, you inspect a deliberately insecure build to recover secrets baked into image layers and learn how BuildKit secret mounts prevent that class of exposure. Upon completion of the module, students will be able to: • Run a Trivy vulnerability scan as a CI gate and interpret CRITICAL/HIGH findings in the scan report. • Lint a Dockerfile with hadolint to identify insecure build patterns before the image is built. • Generate a CycloneDX or SPDX SBOM with Syft and trace a specific package back to its source and version. • Sign an image with Cosign using a local key pair and verify the signature from the consumer side. • Extract secrets from image layers using `docker history` and explain how BuildKit `--secret` mounts prevent the exposure. Skills: `image-scan-gate`, `sbom-review`, `cosign-sign-verify`, `pipeline-harden` Prerequisites: Docker Security Foundations, Docker Runtime Security and Hardening, or equivalent Docker CLI and compose experience. Certifications aligned: NIST SP 800-190 §4.1 (image vulnerabilities), CIS Docker Benchmark §4 (container images and build file), SLSA Level 1-2 (provenance and build integrity), OWASP Docker Top 10 (D04, lack of image integrity validation). For inquiries, please write us at https://www.darkrelay.com/cybersecurity-course-inquiry