Agent Wranglers

INF-83Recommended

Deploy only signed images from tags that cannot move

Make image tags in the registry immutable, sign each image in CI, and let the cluster or host start only images whose signature checks out.

By Agent Wranglers. Updated .

How to do it

A tag that can be overwritten lets anyone with push rights replace a release without a trace. Turn on tag immutability in the registry, such as IMMUTABLE on Amazon ECR, and deploy by digest. Sign the image in CI with the CI job's key or identity, for example with Sigstore cosign. Attach the build provenance and the bill of materials, as the provenance rule describes. Check the signature at deploy time with an admission policy, such as Kyverno, or in the deploy script on a single host. An image built on a laptop then cannot reach production.

Examples

Shell example

# In CI, after the push: sign by digest with the job's identity
cosign sign --yes registry.example.com/shop@sha256:<digest>
# At deploy on a single host: refuse to start an image whose signature fails
cosign verify registry.example.com/shop@sha256:<digest> \
  --certificate-identity-regexp '^https://github.com/example/shop/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Terraform example

resource "aws_ecr_repository" "shop" {
  name                 = "shop"
  image_tag_mutability = "IMMUTABLE"
}

How to check

Pushing the same tag twice to the production registry fails. Deploying an unsigned test image to staging is refused, and a signed one starts.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/signed-immutable-images">Agent Wranglers infrastructure and environments playbook</a>. In code you write, add a comment next to it with the same link.