Docker Integration

Docker Container Signing with TigerTrust

TigerTrust provides enterprise-grade container image signing for Docker environments. Sign images with enterprise code signing certificates, verify image integrity, and enforce signing policies to secure your software supply chain.

Image Signing

Sign container images with TigerTrust:

bash
1# Sign a Docker image
2tigertrust docker sign \
3  --image myapp:v1.0.0 \
4  --certificate code-signing-cert \
5  --registry ghcr.io/myorg
6
7# Output
8✓ Image signed: ghcr.io/myorg/myapp:v1.0.0
9  Digest: sha256:abc123...
10  Signature: sha256:def456...
11  Certificate: CN=MyOrg Code Signing

Cosign Integration

TigerTrust integrates with Sigstore Cosign:

bash
1# Sign with Cosign using TigerTrust certificate
2tigertrust cosign sign \
3  --certificate code-signing-cert \
4  ghcr.io/myorg/myapp:v1.0.0
5
6# Verify signature
7cosign verify \
8  --certificate-identity "[email protected]" \
9  --certificate-oidc-issuer "https://tigertrust.io" \
10  ghcr.io/myorg/myapp:v1.0.0

Registry Integration

Configure automatic signing for registries:

yaml
1# TigerTrust registry signing policy
2registries:
3  - name: production-registry
4    url: ghcr.io/myorg
5    signing:
6      enabled: true
7      certificate: enterprise-code-signing
8      auto_sign: true
9      sign_on_push: true
10
11  - name: staging-registry
12    url: registry.staging.example.com
13    signing:
14      enabled: true
15      certificate: staging-code-signing
16      require_signature: true

Policy Enforcement

Enforce signing policies:

yaml
1# Container signing policy
2policy:
3  name: container-signing-policy
4
5  rules:
6    - name: production-images
7      registries:
8        - "ghcr.io/myorg/*"
9        - "*.prod.example.com/*"
10      requirements:
11        signed: required
12        certificate_issuer: "CN=MyOrg CA"
13        timestamp: required
14        max_age_days: 30
15
16    - name: base-images
17      images:
18        - "*/base-*:*"
19      requirements:
20        signed: required
21        trusted_roots:
22          - enterprise-root-ca
23          - public-ca-bundle

Verification in CI/CD

Verify images before deployment:

yaml
1# GitHub Actions verification
2- name: Verify container signature
3  uses: tigertrust/verify-action@v1
4  with:
5    image: ghcr.io/myorg/myapp:${{ github.sha }}
6    policy: production-policy
7    fail-on-unsigned: true
8
9# Kubernetes admission webhook
10- name: Deploy verified image
11  run: |
12    kubectl apply -f deployment.yaml
13    # TigerTrust admission controller verifies signature

SBOM Signing

Sign Software Bill of Materials:

bash
1# Generate and sign SBOM
2tigertrust sbom generate \
3  --image myapp:v1.0.0 \
4  --format spdx \
5  --sign \
6  --certificate sbom-signing-cert \
7  --output myapp-sbom.json
8
9# Attach SBOM to image
10tigertrust sbom attach \
11  --image ghcr.io/myorg/myapp:v1.0.0 \
12  --sbom myapp-sbom.json

Kubernetes Admission Controller

Enforce signing in Kubernetes:

yaml
1apiVersion: tigertrust.io/v1
2kind: ImagePolicy
3metadata:
4  name: require-signed-images
5spec:
6  namespaces:
7    - production
8    - staging
9
10  rules:
11    - images: ["*"]
12      require:
13        signed: true
14
15    - images: ["ghcr.io/myorg/*"]
16      require:
17        signed: true
18        certificate:
19          issuer: "CN=MyOrg Code Signing CA"
20
21  action:
22    onViolation: reject
23    audit: true

Multi-Architecture Support

Sign multi-architecture images:

bash
1# Sign manifest list
2tigertrust docker sign \
3  --manifest myapp:v1.0.0 \
4  --certificate code-signing-cert \
5  --platforms linux/amd64,linux/arm64
6
7# Verify specific platform
8tigertrust docker verify \
9  --image myapp:v1.0.0 \
10  --platform linux/arm64

Supply Chain Security

Complete supply chain visibility:

• Track image provenance
• Verify build attestations
• Validate source code signatures
• Audit signing history

Secure your container supply chain with TigerTrust's Docker integration.