Securing Container Images: Best Practices for a Robust Containerised Environment

Throughout 2024, my blog posts will draw on my security engineering and architecture experience, sharing practices and lessons from working with AWS over the past decade.

This month, I’m covering container security — specifically, how to protect your containerised infrastructure.

The three pillars I lean on for container images — and have applied in both financial services and government — are: Image Scanning, Immutable Infrastructure, and Signing with Verification.

Pillar One — Image Scanning: Finding Vulnerabilities Before Deployment

Prevention beats cure, and that holds for container security. You need to use container image scanning tools to detect vulnerabilities in your images before they reach production or public repositories. These tools analyse the layers and packages within your images, checking for known vulnerabilities (CVEs), outdated dependencies, exposed secrets, and misconfigurations.

By integrating scanning directly into your CI/CD pipelines — a practice often termed “shifting left” — you can prevent security issues from reaching your live environments, ensuring a more secure and compliant deployment. Here are the tools worth knowing about.

AWS Cloud-Native Tools for Image Scanning

Amazon ECR Image Scanning

Amazon Elastic Container Registry (ECR) offers two scanning modes. Basic scanning uses the open-source Clair engine to check for CVEs when images are pushed. Enhanced scanning, powered by Amazon Inspector, provides continuous, automated vulnerability assessment with richer findings including operating-system and programming-language package vulnerabilities. Results from both modes feed into AWS Security Hub for centralised visibility.

Amazon Inspector

Amazon Inspector (v2) is a fully container-aware vulnerability management service. It automatically discovers and continuously scans container images stored in ECR, as well as running workloads on EC2 and Lambda. Findings are risk-scored using contextual data such as network reachability, and integrate with Security Hub and EventBridge for automated remediation workflows.

Third-Party and Open-Source Image Scanning Tools

Trivy

A hugely popular open-source scanner from Aqua Security, Trivy detects vulnerabilities in OS packages and language-specific dependencies, plus misconfigurations and exposed secrets. It runs as a single binary with no server component, making it trivially easy to plug into CI/CD pipelines.

Clair

An open-source container vulnerability scanner designed for static analysis of container image layers. Clair integrates with container registries and orchestration platforms like Kubernetes to surface known vulnerabilities.

Aqua Security

Aqua provides a comprehensive cloud-native security platform covering image scanning for vulnerabilities and malware, runtime protection, and compliance. It supports the full container lifecycle from build to production.

Prisma Cloud (formerly Twistlock)

Palo Alto Networks’ Prisma Cloud delivers cloud-native security including continuous container image scanning, compliance checks, and runtime policy enforcement across Kubernetes, ECS, and serverless workloads.

Pillar Two — Immutable Infrastructure: Build It Once, Trust It Forever

With immutable infrastructure, your container images stay unchanged throughout their lifecycle. Rather than patching or modifying running containers, you build a new image, test it, and replace the old one. This approach inherently boosts security by minimising the attack surface, eliminating configuration drift, and simplifying rollbacks.

Key Principles

Infrastructure as Code (IaC)

Treat your infrastructure configuration as code. This enables version control, consistency, and reproducibility. It reduces the risk of misconfigurations and enhances security by enforcing configuration standards through your codebase — tools like Terraform, CloudFormation, and CDK make this practical at scale.

Immutable Artifacts

Deploy only immutable artifacts — container images that remain untouched from creation through to deployment. This eliminates the possibility of unauthorised changes or tampering at runtime. Combine this with minimal base images (such as distroless or Alpine-based images) to further reduce the packages an attacker could exploit.

Rollback Simplicity

If issues arise, you revert to a previous, known-good image rather than attempting to diagnose and patch a drifted environment. This drastically simplifies incident response and enables rapid recovery to a verified, secure state.

Applying Immutable Infrastructure to Container Images

In containerised environments, immutable infrastructure means that the image tested and approved in development is precisely the image deployed to production — byte for byte. There are no runtime modifications, no SSH sessions into containers to apply hotfixes, and no configuration drift between environments.

While the advantages are substantial, it is worth acknowledging the challenges: managing stateful components (databases, persistent volumes) requires careful design, and dynamic configuration is best handled through environment variables or secrets managers rather than baked into images. Balancing these considerations with the specific requirements of your applications is the key to successful implementation.

Pillar Three — Signing and Verification: Safeguarding Authenticity and Integrity

Implementing image signing and verification is often the area many organisations struggle with, or fail to implement at all. Yet it’s critical for protecting the authenticity and integrity of your container images.

How It Works

Image signing involves cryptographically signing a container image with a private key, generating a unique signature that acts as a tamper-evident seal. This proves the image originated from a trusted source and has not been altered in transit.

Verification uses the corresponding public key to confirm that the signature is valid. If the image has been modified — even by a single byte — verification fails, and the image is rejected before deployment.

This is especially critical when images are produced for third-party consumption, such as software distribution. Signing provides assurance that the image generated by the developer is precisely the image used in the customer’s environment, free from tampering.

Why This Matters in Practice

Trust in image origin: Signing establishes a verifiable chain of trust, allowing users and systems to confirm an image’s provenance. When combined with a Software Bill of Materials (SBOM), you gain full visibility into what an image contains and where it came from.

Integrity assurance: Verification ensures the deployed container matches the signed version exactly, mitigating the risk of supply-chain attacks where images are tampered with in a registry or during transit.

Tools and Technologies for Image Signing

Docker Content Trust (DCT)

Integrated into Docker, DCT enables signing and verification using the Docker Notary service. It supports content trust enforcement during image pulls and offline signing for enhanced security.

Cosign (Sigstore)

An open-source tool from the Sigstore project, purpose-built for signing and verifying container images and other OCI artifacts. Cosign integrates smoothly with CI/CD pipelines, supports keyless signing via OIDC identity providers (removing much of the key management burden), and can attach signatures directly to OCI registries alongside the images they protect.

Enforcing Signed Images at Deployment

Signing images is only half the equation — you also need to enforce verification at deployment time. In Kubernetes, admission controllers such as Kyverno or OPA Gatekeeper can reject any pod that references an unsigned or unverified image. For ECS, you can enforce image signing policies through custom pre-deployment checks in your CI/CD pipeline.

Best Practices and Considerations

Key management remains the hardest practical challenge. Safeguard private keys using a hardware security module (HSM) or a managed service like AWS KMS, and ensure secure distribution of public keys. Keyless signing approaches (as offered by Cosign and Sigstore’s Fulcio CA) are worth evaluating, as they significantly reduce the operational burden.

Integrate signing and verification into your CI/CD pipelines to automate the process and guarantee consistent security checks without manual overhead.

---

Image signing and verification form a powerful, often underestimated layer of defence in container security. Combined with rigorous image scanning and an immutable infrastructure approach, these three pillars provide a solid foundation for any containerised environment.

In the next blog post, I’ll be diving deep into Identity and Access Management roles for ECS/EKS Tasks. We’ll explore how you can follow the principle of least privilege and help you really grasp the difference between Task Roles and Service Roles.

Until then, keep your head in the clouds.