Skip to content
Knowledge Base

Container Management

Image provenance, lifecycle, and runtime controls for container workloads.

1

Verifying What's Actually Running in Production: Build Diff vs Runtime Reality

Hash what's actually executing in production, diff it against the build artifact, and catch agent-authored Dockerfile drift before an incident makes you wish you had.

Intermediate 8 min read
2

Container Provenance for AI-Generated Builds: SLSA Attestations When the Source Is Half Human, Half Agent

How to issue SLSA Build provenance attestations on container images when an autonomous coding agent contributed to the Dockerfile, the build script, or the source — without losing the audit trail.

Advanced 9 min read
3

Pinning Base Images When AI Agents Author Dockerfiles

Coding agents reach for `:latest` by reflex. Here is the SHA-pinning, Renovate-driven workflow that lets agents touch Dockerfiles without breaking your supply chain.

Intermediate 8 min read
4

SBOM Diff for Container Updates Authored by Coding Agents

When an autonomous agent rewrites a Dockerfile or bumps a dependency, you want a CycloneDX SBOM diff in the PR — not a CVE in production. Here is the pattern.

Intermediate 8 min read
5

Detecting Drift Between Dev Container and Prod Image

When agents iterate locally inside a devcontainer, the prod image you ship can quietly diverge. Cosign attestation diffs catch the gap before incidents do.

Advanced 9 min read
6

Gold Images for Incident Response: How to Verify That What's Running Is What You Built

Using hardened base images, cryptographic signing, and policy enforcement to answer 'is this container what we actually built?' during an incident.

Intermediate 11 min read