Securing the Container Supply Chain with Cosign, Sigstore, and Kyverno

Container registries are often treated as trusted internal storage. In reality, without cryptographic signature verification, any compromised CI token or registry credential allows malicious actors to push a backdoored container image using an existing release tag (such as ':latest' or ':v2.1.0').

In 2026, securing the software supply chain requires cryptographic proof of provenance. Sigstore Cosign provides keyless, OIDC-backed image signing. Combined with open-source admission controllers or local Docker verification hooks, engineering teams can ensure that production hosts run only code signed by verified GitHub Actions workflows.

The Keyless Container Signing Workflow

Sigstore eliminates the pain of managing and rotating private PGP or RSA signing keys:

• Ephemeral Keys & OIDC: During the CI build, Cosign generates an in-memory key pair. It proves identity to Sigstore Fulcio using the GitHub Actions OpenID Connect (OIDC) token.
• Short-Lived Certificate: Fulcio issues an X.509 certificate valid for exactly 10 minutes tied to the repository and workflow identity.
• Public Transparency Log (Rekor): The cryptographic signature and certificate are published to Rekor, providing an immutable audit trail.
• Host Verification: Before deploying on the VPS, the host verifies the signature against the Sigstore public root of trust.

Signing Container Images in GitHub Actions

Here is a secure workflow signing images immediately after push:

# .github/workflows/build-sign.yml
name: Build and Sign Container

on:
  push:
    tags: ['v*']

permissions:
  contents: read
  packages: write
  id-token: write # Required for keyless Sigstore OIDC minting

jobs:
  build-and-sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: sigstore/cosign-installer@v3.5.0

      - name: Build and Push Docker Image
        id: build
        run: |
          IMAGE="ghcr.io/${{ github.repository }}:${{ github.ref_name }}"
          docker build -t "$IMAGE" .
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
          docker push "$IMAGE"
          echo "DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE")" >> $GITHUB_OUTPUT

      - name: Sign Container Image (Keyless)
        run: |
          cosign sign --yes "${{ steps.build.outputs.DIGEST }}"

Verification on the Production VPS

Before deploying a container image, verify its cryptographic signature:

#!/usr/bin/env bash
set -euo pipefail

IMAGE_DIGEST="ghcr.io/netbay-org/app@sha256:7c92b49e1..."

echo "Verifying image signature against Rekor transparency log..."
cosign verify   --certificate-identity-regexp "^https://github.com/netbay-org/app/"   --certificate-oidc-issuer "https://token.actions.githubusercontent.com"   "$IMAGE_DIGEST"

echo "Signature verified! Launching container..."
docker run -d -p 3000:3000 "$IMAGE_DIGEST"

Expand

Video Reference on Cloud Native Security

Learn more about container supply chain protection and cloud security foundations:

Cryptographically signing and verifying container images protects your production infrastructure against unauthorized code injection and supply chain compromises.

Deploy hardened production nodes with automated security scanning on Netbay Cloud VPS at netbayhosts.in.