---
title: "Deploy only signed images from tags that · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/signed-immutable-images
id: INF-83
level: Recommended
applies: servers
updated: 2026-10-27
build: a2a6bdfed830
tokens: 906
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Deploy only signed images from tags that cannot move

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-83
- Level: Recommended
- Chapter: [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)
- Rule: Make image tags in the registry immutable, sign each image in CI, and let the cluster or host start only images whose signature checks out.
- Check: Pushing the same tag twice to the production registry fails. Deploying an unsigned test image to staging is refused, and a signed one starts.
- Applies when: The project runs its own servers, virtual machines or containers.
- How: A tag that can be overwritten lets anyone with push rights replace a release without a trace. Turn on tag immutability in the registry, such as `IMMUTABLE` on Amazon ECR, and deploy by digest. Sign the image in CI with the CI job's key or identity, for example with Sigstore cosign. Attach the build provenance and the bill of materials, as [the provenance rule](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) describes. Check the signature at deploy time with an admission policy, such as Kyverno, or in the deploy script on a single host. An image built on a laptop then cannot reach production.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# In CI, after the push: sign by digest with the job's identity
cosign sign --yes registry.example.com/shop@sha256:<digest>
# At deploy on a single host: refuse to start an image whose signature fails
cosign verify registry.example.com/shop@sha256:<digest> \
  --certificate-identity-regexp '^https://github.com/example/shop/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
```

### Terraform example

```hcl
resource "aws_ecr_repository" "shop" {
  name                 = "shop"
  image_tag_mutability = "IMMUTABLE"
}
```

## Sources

- [Amazon ECR, Preventing image tags from being overwritten](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html)
- [SLSA specification v1.1](https://slsa.dev/spec/v1.1/)

## Related rules

- APS-75 [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/signed-immutable-images">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Enforce the restricted pod security standard](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/pod-security-standards.md)
- Next: [Rescan the images that are running every day](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/rescan-running-images.md)
- [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)