Container registry security image management

🎭 Role

You are a Principal Cloud Security Architect and DevSecOps Engineer with extensive experience in designing hardened, enterprise-grade container delivery pipelines. Your expertise spans registry architecture, supply chain security, and cloud-native governance frameworks.

🌐 Context

[ORGANIZATION_NAME] is architecting a secure, scalable container image management strategy to support [NUMBER] development teams across [CLOUD_PROVIDER/ON-PREM] environments. The goal is to enforce a "Secure by Design" philosophy, ensuring that every container image from inception to production is verified, scanned, and compliant with industry standards like NIST/CIS benchmarks.

🛠️ Task Instruction

Provide a comprehensive technical blueprint for the following four pillars of container security:

1. Registry & Identity Infrastructure:

   • Define a secure architecture for [REGISTRY_TYPE] (e.g., Harbor, ECR).
   • Design an RBAC model integrated with [IDP_PROVIDER] (e.g., OIDC, IAM) and specify token-based authentication mechanisms.

2. Supply Chain Security & Image Integrity:

   • Define a signing strategy using [SIGNING_TOOL] (e.g., Cosign, Notary).
   • Detail the automated integration of vulnerability scanning (e.g., Trivy, Clair) into CI/CD workflows.
   • Outline strict admission controller policies that block deployments based on specific CVSS severity thresholds.

3. Lifecycle & Governance Policy:

   • Establish a robust tagging strategy (Semantic Versioning/Immutable tags).
   • Define lifecycle management (retention/cleanup) to optimize storage while maintaining audit compliance.
   • Propose a Base Image Governance program to minimize attack surfaces (e.g., using Distroless, scratch, or hardened Alpine).

4. Operational Excellence:

   • Propose a disaster recovery and high-availability strategy (multi-region replication).
   • Explain the process for generating and storing an SBOM (Software Bill of Materials) for every build.

⚖️ Constraints & Tone

• Tone: Professional, technical, authoritative, and prescriptive.
• Length: Concise but detailed enough to serve as a technical specification document.
• Prohibitions: Do not suggest unproven or experimental tools; prioritize industry-standard, battle-tested solutions.
• Governance: Always emphasize the "Principle of Least Privilege" and "Shift Left" security principles.

📝 Output Format

• Use a structured report format with clear headings for each pillar.
• Include a Security Checklist summary at the end.
• Use code blocks for configuration examples or policy snippets (e.g., OPA/Rego policies, Dockerfile best practices).
• Use Markdown tables for comparing tools or policies where appropriate.

🧩 Variables

• [ORGANIZATION_NAME]:
• [CLOUD_PROVIDER/ON-PREM]:
• [REGISTRY_TYPE]:
• [IDP_PROVIDER]:
• [SIGNING_TOOL]: