Cloud Native Security Con 2023 Demo Code

The distroless directory contains two solutions to the problem of creating an attestation that proves a property like "this container uses a distroless base image". The one we demoed onstage is distroless/cosign that uses a basic on-host key with the sigstore policy controller. There's also a distroless/binauthz solution that you'd use on GKE with KMS-managed keys (which we didn't demo).

The distroless/is_distroless.sh script shows you how you can use gcrane to pull out a file to determine the OS base image.

The gatekeeper_repo_policy directory contains the solution to install a gatekeeper policy to restrict the container registry/repo targets allowed in Kubernetes manifests.

The golang_vulns directory contains the govulncheck example program and demo.