Especially when it comes to secure software development, there is often a gap in how things should be and how they are actually are. For example, with container images: We know we should only use images from trusted sources, build our images ourselves, constantly scan for vulnerabilities, have reproducible builds in the CI and on top of it making sure that everyone and every system in the organization is aligned with those standards. The road to hell is paved with good intentions. We know the reality is different, but how can we implement it so that the simple goals will have simple solutions that aren't soaked in the blood of complexity picked up along the way?

In this session, Vadim will take you on an adventure, where he paints a story of a hero character who systematically solves one tiny quest after the other and slowly but steadily progresses from one level to another to meet the final boss.

In the adventure you learn how Linux Foundation OSS tools like Harbor, Kyverno, Sigstore and Kubernetes are used to build Open Container Initiative (OCI) centric workflows for secure image management. While preserving a frictionless developer experience. You learn how to grow your organization’s security posture gradually, from zero to hero. Manage 3rd party images securely. Restrict image pulls to trusted sources. Require up-to-date vulnerability scans. Assure that all images are signed. Enforcing policies across the CI/CD pipeline and at runtime.