Skip to main content

Organisational Policies - Containers and Images

The effective application of Chapter 09 - Containers and Images requires the existence of formal organisational policies that frame and reinforce the practices of building, validation, signing, governance and execution of containers and images.

These policies ensure that:

  • Images are built in a secure, traceable and reproducible way, with verifiable provenance;
  • The execution of containers takes place in protected, auditable and controlled environments;
  • There is clear governance over the registries and pipelines that handle containerisation artefacts.

📄 Relevant Organisational Policies​

Policy NameMandatory?ApplicationSummary of the Required Content
Secure Image Building Policy✅ YesAll build pipelinesDefines requirements for a secure base, digest pinning, fixed versions, linting and automatic validation of Dockerfiles; mandates review and approval before publication.
Image Vulnerability Management Policy✅ YesCI/CD registries and pipelinesMandates automated scanning (SCA, CVE, licences); defines severity criteria and remediation deadlines; blocking on critical vulnerabilities.
Image Signing and Provenance Policy✅ YesInternal and external registriesRequires digital signing (Sigstore/Cosign), SLSA attestations and integrity verification before execution.
Container Registry and Repository Governance Policy✅ YesAll internal registries and repositoriesDefines ownership, access control, RBAC, retention, periodic cleanup, audit and access logs.
Container Hardening and Secure Execution Policy⚠️ ReinforcedExecution environments (Docker, Kubernetes, etc.)Defines minimum isolation parameters (seccomp, AppArmor, SELinux), network policies, least privilege and read-only rootfs.
Obsolete Image Management and Cleanup Policy⚠️ RecommendedRepositories and pipelinesEstablishes retention periods, rebuild policies and the removal of vulnerable or unused images.
Deploy Manifest Validation and Approval Policy⚠️ ReinforcedKubernetes, Compose, HelmMandates automated validation of manifests with policy-as-code (OPA, Conftest) and security admission controllers.
Container Execution Observability and Audit Policy⚠️ ReinforcedProduction environmentsDetermines the collection of metrics, runtime logs, commit-digest-deploy correlation and automatic alerts for shadow containers.

📃 Minimum structure of each policy​

Each policy must contain:

  • Objective and scope (artefacts, pipelines, environments covered);
  • Roles and responsibilities (DevOps, Cloud Ops, AppSec, Audit);
  • Mandatory technical controls (automatic validations, gates, segregation of duties);
  • CI/CD integration (control points and automatic blocks);
  • Evidence and metrics (scan reports, logs, attestations, audits);
  • Review frequency and the policy update procedure.

✅ Final recommendations​

  • All policies must be published and approved by security and engineering management, and integrated into DevSecOps processes.
  • Compliance must be validated periodically through checklists, technical audits and maturity metrics.
  • The policies must align with the practices of Dependency Management (Ch. 05) and IaC (Ch. 08) to guarantee the coherence of the supply chain.
  • Automating compliance verification via policy-as-code is recommended, integrating the rules into the build and deploy pipelines.
  • The application of these policies constitutes direct evidence of compliance with SSDF, SLSA, CIS, ENISA and SAMM in the context of software supply chain security.

📁 Templates and practical examples may be included in future versions of the manual as complementary 60-*.md files.