Lock Up Image Attestation For Free

Docker Buildx is a command-line tool that provides advanced capabilities for building and managing multi-platform Docker images. Basically, it is an extension to the regular docker build command.

A single attestation can authorize identical images that are stored in multiple different locations or different registries, such as Artifact Registry, Container Registry, or an external container registry. At deploy time, Binary Authorization uses attestors to verify attestations.

To remove the Docker build cache, we can run the docker buildx prune command to clear the build cache of the default builder. If we want to remove the build cache for a specific builder, we can use the --builder flag to specify the builder name.

Attestation is a confidential computing keystone. With attestation, workload owners can fully assert the trustworthiness of the hardware and software environment their workload is running in, regardless of the security posture of the underlying infrastructure provider.

The Docker prune command automatically removes the resources not associated with a container. This is a quick way to get rid of old images, containers, volumes, and networks. You can use additional indicators with this command: Add -a to display all resources, and -q to display only ID.

The provenance attestations include facts about the build process, including details such as: Build timestamps. Build parameters and environment. Version control metadata. Source code details.

Attestation Manifest Attestation manifests are attached to the root image index object, under a separate OCI image manifestopen_in_new. Each attestation manifest can contain multiple attestation blobs, with all the of the attestations in a manifest applying to a single platform manifest.