How would you secure the software supply chain from source code to a running container in production?

Question

RED SAG · Accepted Answer

I think of each step as something an attacker could tamper with. For source, I use branch protection, required reviews, CODEOWNERS and secret scanning. Builds run on ephemeral, isolated runners with least-privilege tokens, and third-party actions and base images are pinned by commit SHA or digest. Dependencies are scanned, and tools like Renovate keep them updated in small steps. The pipeline generates an SBOM and build provenance following SLSA, and signs the image with Sigstore cosign, ideally keyless with OIDC identity. The image is pushed by digest to a registry with tag immutability. At deploy time, an admission controller such as Kyverno or Sigstore policy-controller only allows images that are signed by our pipeline, have provenance, and pass vulnerability policy. In production, runtime security and regular rescanning catch new CVEs in old images.

How would you secure the software supply chain from source code to a running container in production?

What the interviewer wants to hear

Model answer

More hard DevOps Engineer questions