## Container Image Security

"Supply Chain Security."

### Scanning Images
Before you deploy, scan the image.
*   **Tools**: Trivy, Grype, Clair.
*   **Process**: CI/CD Pipeline.
    *   Developer commits code.
    *   Jenkins builds image.
    *   Trivy scans image.
    *   If `Critical Vulnerabilities > 0`: **Fail Build**. (Do not deploy).
    *   Else: Deploy.

### Minimal Base Images
*   **Bloat**: Using `ubuntu:latest` (700MB) includes Curl, Wget, Netcat, Grep. Hackers love these tools ("Living off the Land").
*   **Minimal**: Using `alpine` (5MB) or Google `distroless`.
    *   Contains *only* the application binary. No Shell. No Curl.
    *   *Result*: Beating the hacker by removing their weapons.

### Signing Images (Notary)
How do you know this image actually came from your developer and wasn't injected by a hacker?
*   **Cosign / Notary**: Digitally sign images. Kubernetes verifies the signature before running.