World map

 

BM

World D5: Ship & Shield

SBOM, provenance and signing

You will learn: to ship an ingredients list and a "made here" record with your image, and what a signature adds.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

Tonight, a new hole is found in musl. You run 30 images. Which of them have musl inside?

Watch

bash
docker buildx imagetools inspect ghcr.io/you/kedai-api:1.0 --format '{{ range .SBOM.SPDX.packages }}{{ .name }} {{ .versionInfo }}{{ "\n" }}{{ end }}' | grep -E '^(node|npm|musl|kedai-api) '
kedai-api 1.0.0
musl 1.2.6-r3
node 24.22.2
npm 11.19.1

An SBOM: Software bill of materials: the ingredients label. It lists every package and version inside. is the ingredients list: every package and its version. This image lists 168. Yes, musl is in it.

Try it

provenance: A signed "made here" label: which repo, commit and workflow built this image. is the “made here” record: which recipe, which inputs, how. BuildKit can add both labels as it builds. Build that command.

Tap the pieces in the right order.

…

Watch

The labels travel with the image, in the same registry. Real output from docker buildx imagetools inspect.

Tap the line that marks the labels.

0 of 1 found

Watch

signing: A tamper-proof seal on an image's digest. Anyone can check it before they run the image. adds a tamper-proof seal. Sigstore’s cosign signs the image’s digest. Put the steps in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • Check the seal before you run it
  • Build the image
  • Push it to the registry
  • Sign its digest

Predict

Someone swaps the pack in the freezer. Same tag, new bytes. What does the seal check say?

You did it!

You can now ship an image with its ingredients list and “made here” record.

Go deeper (optional)

BuildKit adds a small provenance record by default (mode=min). Attestations need the containerd image store, the default for new Docker 29 installs. Keyless signing uses your GitHub or Google login. It writes to a public log. Part 2, World C2 signs in CI with actions/attest.

Real rep (optional), after logging in to GHCR (lesson 2):

Real mission

  1. docker buildx build --sbom=true --provenance=mode=max -t ghcr.io/YOUR-NAME/kedai-api:1.0 --push .
  2. docker buildx imagetools inspect ghcr.io/YOUR-NAME/kedai-api:1.0 --format '{{ json .SBOM.SPDX }}'

0 of 3 steps done · Your ticks are saved.