Docker interview question · Most asked
What is a software supply chain attack on containers, and how do you defend against it?
Summary
An attacker compromises something you build from rather than your code directly: a malicious or typo-squatted base image, a compromised dependency, a tampered CI pipeline, or a pushed image replaced in a registry. Defences: trusted, pinned sources; vulnerability and malware scanning; signed images with signature verification before deploy; SBOMs and provenance attestations; and locked-down CI and registries.
Longer Answer
Frameworks such as SLSA describe levels of build integrity. Practical steps: use official or verified-publisher images and internal mirrors; pin by digest; generate provenance with BuildKit (--provenance, --sbom); sign with Sigstore cosign; verify signatures at admission in Kubernetes (Kyverno, policy-controller); enable registry tag immutability; and require least-privilege, short-lived credentials in CI.
Key Points
- Attacks via bases, dependencies, CI, registries.
- Pin, scan, sign, verify.
- SBOM and provenance (SLSA).
- Locked-down CI and registries.
More most-asked Docker questions
- What is the difference between an image and a container, and how do image layers work?
- What is a container, and how does it differ from a virtual machine?
- What are multi-stage builds, and why use them?
- CMD or ENTRYPOINT: what is the difference, and what are exec and shell forms?
- How does Docker build caching work, and how do you order a Dockerfile to use it well?
- What are Dockerfile best practices for production images?
- ARG or ENV: what is the difference, and how do you pass secrets into a build safely?
- How do you secure Docker containers and images?