> Markdown version of [/events/world-congress-2026-north-america/sessions/1726-stop-running-mystery](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1726-stop-running-mystery). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Stop Running Mystery Meat in Production


- **Event:** World Congress 2026 North America

## Description

We have all been there. You need a database or a quick node environment, so you throw "FROM node:latest" into your Dockerfile and deploy. It works, but you have just introduced a black box into your Kubernetes cluster.

For the Developer, it’s a quick fix. For the Platform Engineer, it’s a nightmare.

Most upstream images from public registries are a roll of the dice. They come pre-packed with critical vulnerabilities, unknown binaries, and bloated libraries that you didn’t ask for and definitely don’t want running in your secure environment. In a world of Zero Trust, why are we trusting random upstream maintainers with the keys to our infrastructure?

In this session, we will dismantle the myth that "open source means secure" when it comes to container images. We will walk through the architecture of a truly Secure Software Delivery pipeline—one that establishes trust before a single line of code is committed. We will discuss:

- The hidden dangers inside popular "official" images.
- Moving beyond basic scanning: Why you need SLSA L3 provenance, SBOMs, and cryptographic attestation.
- The "Build vs. Buy" dilemma: Should you curate your own base images or rely on a hardened upstream provider?

Join us to learn how to bridge the gap between developer velocity and platform security, ensuring that the only thing running in your cluster is code you actually trust.


## Speaker

### [Jeroen van Erp](https://www.wearedevelopers.com/@jeroen-van-erp)

Technical Advocate @ SUSE


## Related talks at this congress

- [rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1718-rm-rf-horror-stories) — Rishab Kumar
- [On the Public Clock: Open-Source Defense When You're Not in the Club](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1683-on-the-public-clock) — Nicholas Muy
- [Run your agents in Kubernetes: Build once, deploy anywhere. But really?](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1676-run-your-agents-in) — Michal Salanci
- [It’s Alive! Taming the MLOps Franken-Stack: Write, Run, and Serve with Michelangelo](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1675-it-s-alive-taming) — Eric Wang, Paul Zimmerman

## Watch remotely

Can’t make it to San José? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/world-congress-north-america/tickets)