securing-container-registry-images

name	securing-container-registry-images
description	Securing container registry images by implementing vulnerability scanning with Trivy and Grype, enforcing image signing with Cosign and Sigstore, configuring registry access controls, and building CI/CD pipelines that prevent deploying unscanned or unsigned images.
domain	cybersecurity
subdomain	cloud-security
tags	["cloud-security","containers","registry","image-scanning","trivy","cosign","supply-chain"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1078.004","T1530","T1537","T1580","T1610"]
source	https://github.com/mukul975/Anthropic-Cybersecurity-Skills
source_commit	04450304b12645cb2b974ab96d28c0664758a88d
note	Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics/threat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.

Securing Container Registry Images

When to Use

• When establishing security controls for container image registries (ECR, ACR, GCR, Docker Hub)
• When building CI/CD pipelines that enforce vulnerability scanning before image promotion
• When implementing image signing and verification to prevent supply chain attacks
• When auditing existing registries for vulnerable, unscanned, or unsigned images
• When compliance requires software bill of materials (SBOM) for deployed container images

Do not use for runtime container security (use Falco or Sysdig), for Kubernetes admission control (use OPA Gatekeeper or Kyverno after establishing registry controls), or for host-level vulnerability scanning (use Amazon Inspector or Qualys).

Prerequisites

• Trivy installed (brew install trivy or apt install trivy)
• Grype installed (curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh)
• Cosign installed for image signing (go install github.com/sigstore/cosign/v2/cmd/cosign@latest)
• Syft installed for SBOM generation (curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh)
• Container registry access (ECR, ACR, GCR, or private registry)

Workflow

Step 1: Scan Images for Vulnerabilities with Trivy

Run comprehensive vulnerability scans against container images before and after pushing to the registry.

# Scan a local image for vulnerabilities
trivy image --severity HIGH,CRITICAL myapp:latest

# Scan a remote registry image
trivy image --severity HIGH,CRITICAL 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:latest

# Scan with JSON output for CI/CD processing
trivy image --format json --output trivy-results.json myapp:latest

# Scan for vulnerabilities AND misconfigurations
trivy image --scanners vuln,misconfig,secret myapp:latest

# Scan a specific image with SBOM output
trivy image --format spdx-json --output sbom.json myapp:latest

# Fail CI/CD if critical vulnerabilities found
trivy image --exit-code 1 --severity CRITICAL myapp:latest

Step 2: Scan with Grype for Additional Coverage

Use Grype as a complementary scanner for broader vulnerability database coverage.

# Scan image with Grype
grype myapp:latest


grype myapp:latest --fail-on critical


grype myapp:latest -o json > grype-results.json


syft myapp:latest -o spdx-json > sbom.json
grype sbom:sbom.json


grype :/path/to/image-rootfs