Container Supply Chain Security

Container Supply Chain Security

Supply chain attacks represent one of the most significant emerging threats to container security. Attackers target build pipelines, base images, and third-party dependencies to inject malicious code that propagates to production deployments. The SolarWinds and Codecov incidents demonstrated supply chain vulnerabilities, spurring increased focus on securing the container build and distribution pipeline.

Software Bill of Materials (SBOM) provides transparency into container contents. SBOM documents every component, library, and dependency within containers. This transparency enables vulnerability tracking and license compliance. Standard formats like SPDX and CycloneDX facilitate SBOM exchange between tools. Organizations should generate and maintain SBOMs for all container images.

#!/bin/bash
# Example: Container supply chain security implementation

# Generate SBOM for container image
generate_sbom() {
    local image=$1
    local output_dir="./sboms"
    mkdir -p $output_dir
    
    echo "Generating SBOM for $image..."
    
    # Use Syft to generate SBOM in multiple formats
    syft $image -o spdx-json > $output_dir/$(echo $image | tr '/:' '_')-spdx.json
    syft $image -o cyclonedx-json > $output_dir/$(echo $image | tr '/:' '_')-cyclonedx.json
    
    # Generate attestation
    cosign attest --key cosign.key --type spdx \
        --predicate $output_dir/$(echo $image | tr '/:' '_')-spdx.json \
        $image
}

# Verify supply chain integrity
verify_supply_chain() {
    local image=$1
    
    echo "Verifying supply chain for $image..."
    
    # Verify image signature
    cosign verify --key cosign.pub $image
    
    # Verify SBOM attestation
    cosign verify-attestation --key cosign.pub \
        --type spdx $image
    
    # Check for known vulnerabilities in SBOM
    grype sbom:$output_dir/$(echo $image | tr '/:' '_')-spdx.json
    
    # Verify base image provenance
    local base_image=$(docker inspect $image | jq -r '.[0].Config.Image')
    if [[ ! -z "$base_image" ]]; then
        verify_base_image_provenance $base_image
    fi
}

# Implement SLSA framework compliance
implement_slsa_compliance() {
    local repo=$1
    local level=$2
    
    case $level in
        1)
            echo "Implementing SLSA Level 1..."
            # Automated build process
            setup_automated_builds $repo
            ;;
        2)
            echo "Implementing SLSA Level 2..."
            # Hosted build service
            setup_hosted_build_service $repo
            # Generate provenance
            enable_provenance_generation $repo
            ;;
        3)
            echo "Implementing SLSA Level 3..."
            # Non-falsifiable provenance
            setup_secure_build_service $repo
            # Isolated builds
            enable_hermetic_builds $repo
            ;;
        4)
            echo "Implementing SLSA Level 4..."
            # Two-party review
            enable_two_party_review $repo
            # Hermetic, reproducible builds
            enable_reproducible_builds $repo
            ;;
    esac
}