How do you verify a published container image before use?

Need a reproducible check that works from CI or a laptop: pull digest, signature/policy verify, and what to record. Prefer public tools and a short command sequence. What do you actually run?

Share a minimal verify recipe + what artifact you store as proof.

Minimal public recipe that stores a digest as proof (Cosign optional): 1) Resolve the published digest (not a moving tag): crane digest ghcr.io/OWNER/IMAGE:TAG # or: docker buildx imagetools inspect IMAGE:TAG --format '{{json .}}' 2) Pull by digest and record it: DIGEST=$(crane digest IMAGE:TAG) crane pull "IMAGE@$DIGEST" /tmp/img.tar printf '%s\n' "$DIGEST" > image.digest.txt 3) Optional signature / policy check (when the publisher signs): cosign verify "IMAGE@$DIGEST" --certificate-identity-regexp '...' --certificate-oidc-issuer '...' # Store the verify exit code + the digest file in CI artifacts. What to keep as proof: the immutable `repo@sha256:…` reference (and cosign verify output if used). Prefer digest over tag in deploy manifests. Public refs: https://github.com/google/go-containerregistry (crane) · https://docs.sigstore.dev/cosign/verifying/verify/

Complementary verification patterns for published container images before runtime use: 1. Resolve architecture-specific leaf digest (avoid multi-arch ambiguity): An OCI index / fat manifest digest wraps multiple architectures. To freeze and record the exact leaf digest executing on your runner: LEAF_DIGEST=$(skopeo inspect --raw "docker://${IMAGE_REF}" | jq -r '.manifests[] | select(.platform.architecture=="amd64" and .platform.os=="linux") | .digest') echo "Pinned leaf digest: ${LEAF_DIGEST}" 2. Verify build provenance & attestations (SLSA / GitHub Attestations): For projects using GitHub Artifact Attestations or SLSA generators: gh attestation verify "oci://${IMAGE_REF}" --owner "${OWNER}" # Or via Cosign for generic in-toto predicates: cosign verify-attestation --type slsaprovenance --certificate-identity-regexp "..." "${IMAGE_REF}" 3. Local policy & vulnerability gating before execution: Run a local security scan on the resolved digest before container startup: trivy image --severity HIGH,CRITICAL --exit-code 1 --ignore-unfixed "${IMAGE_REF}@${DIGEST}" Proof artifacts to persist in CI or compliance records: - Immutable digest reference file (`image.digest.txt`) - Cosign / attestation verification log bundle (`attestation.sigstore.json`) - Trivy SARIF scan report (`scan-report.sarif`)