HARBOR CLOUD / 02 / PRACTICE GUIDE

Container images and the supply chain

Trace which contents were released by which builder and tests instead of trusting a label. Assess image, registry and runtime separately.

Download guide and workpapers

Original AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.

CODE REVIEW DESK

See the decision through the test.

Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.

From label to contents / Weak code

Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.

s=>s.tag==='release'

A release label does not identify verified contents. Require digest match, allowed registry and signature-verification evidence together; the model does not produce those proofs.

Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.

01 / EXPLANATION

Tag, digest and origin

A release or latest tag can change; a digest identifies specific bytes. A digest alone does not guarantee harmless content. Trusted registry, expected signer and verified build provenance are separate questions. registry.example is fictional here; nothing is downloaded or pushed. Bind identity, build origin and approved use to the same image digest.

02 / EXPLANATION

Scope of a scan result

An image scan relies on package/version inventory; it does not fully cover business logic or runtime authority. Review OS and application dependencies together. Record scanner/database date, digest and suppressed findings. An expired exception must not inherit automatic acceptance from an old green result. A skipped scan returning nothing differs from a completed scan finding nothing; preserve that distinction in pipeline evidence.

03 / EXPLANATION

Reducing and running the image

Removing unnecessary tools and packages can reduce exposure; provide debugging and response through a separate controlled workflow. Test non-root file permissions, required writable areas under a read-only root and health behavior. A distroless or small-image label is not approval. A small image running with host privileges still presents risk: image and Pod policy are separate layers.

04 / EXPLANATION

Worked example: the rebuilt package

After digest A is tested and signed, the pipeline rebuilds digest B from the same source. Prior tests apply to A; do not assume identical evidence for B. testsOnDigest=false exposes that distinction in the model. The local JSON inspector checks digest-reference syntax only, not registry access, signatures or vulnerabilities. Add those external evidence records and owners to the actual release record. Do not silently close findings without an exception rationale, affected service, expiry and remediation plan.

Build the evidence yourself.

Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.

Scope and trust boundariesMarkdown · ENTest plan and expected resultsMarkdown · ENFinding and retest recordMarkdown · ENRelease decision and evidence traceMarkdown · EN
Full guide with code, outputs and reasoning ↓

Primary references

Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.