Signed Images, Runtime Watchtowers, and Why Docker Pull Is an Act of Faith

Originally published on Podo Stack Every time you run docker pull , you're trusting that nobody tampered with that image between the build and your cluster. npm has signatures. Go modules have checksums. Docker images? Most of us just... hope for the best. This week: supply chain security. The trust chain from build to runtime, and how to stop flying blind. The Pattern: Supply Chain Trust The problem is invisible SolarWinds. Codecov. ua-parser-js. The pattern is always the same: attackers compromise the build or distribution pipeline, inject malicious code, and it flows downstream into production. Nobody notices because the artifact looks legitimate. Container images have the same blind spot. You pull nginx:1.25 , but how do you know it wasn't modified after the maintainer pushed it? You don't. Not unless you verify. Three layers of defense Good supply chain security works in layers - multiple checks, each catching what the previous one missed. Layer 1: Build time - scan in CI. Tools l