WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 10, 2026 • Session details

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Basic SBOMs can no longer stop self-propagating CI worms. Master advanced zero-trust pipelines and hardened image strategies to achieve ironclad container resilience.

Pause
Mute Enter Fullscreen
#1 about 3 min

Understanding software vulnerabilities and prominent exploits

How widespread vulnerabilities like Log4Shell and React2Shell drive the need for security improvements.

#2 about 3 min

Generating software bill of materials for container images

Using CLI tools like Syft to generate machine-readable SBOMs that list all structural dependencies of an application.

#3 about 1 min

Scanning Docker images for vulnerabilities with Docker Scout

Checking final container images for embedded vulnerabilities that originate from the base operating system.

#4 about 4 min

Creating SBOM attestations for multi-stage Docker builds

Attaching build-phase SBOMs to capture vulnerable dependencies that are discarded in the final image layer.

#5 about 6 min

Reducing vulnerability footprints with hardened Docker images

Dropping tools like package managers and shells to create base images with minimal initial vulnerabilities.

#6 about 2 min

Filtering unexploitable vulnerabilities using VEX attestations

Silencing irrelevant vulnerability alerts by creating records that mark specific issues as non-exploitable.

#7 about 2 min

Signing container images to prevent pipeline tampering

Using Cosign and OCI referrers to generate signatures that guarantee the integrity of production images.

#8 about 2 min

Continuous scanning for zero-day vulnerabilities in containers

Retrospectively checking existing SBOM attestations to catch newly discovered vulnerabilities in older base images.

#9 about 2 min

Securing build pipelines with the SLSA framework

Generating provenance metadata to track the build environment and history of a container image.

#10 about 4 min

Defending against automated supply chain worms

Identifying and mitigating malware families that infect maintainer environments to spread through package registries.

#11 about 3 min

A practical checklist for DevSecOps and container security

Implementing proactive strategies like version pinning, cool-down periods, and execution sandboxes to defend CI pipelines.

#12 about 2 min

Addressing zero-day exploits and alternative hardened images

Insights on managing exposure windows during active breaches and comparing different proprietary hardened image providers.

Matching moments

3:09 min

Practical mitigation strategies for modern software supply chains

Adrian Mouat Adrian Mouat · WWC Europe 2026

6:33 min

Integrating SAST and container security into developer workflows

Mathias Tausig · LIVE

2:46 min

Mapping the complete software supply chain attack surface

Matthew Brady Matthew Brady · WWC Europe 2026

1:55 min

Addressing base image vulnerabilities in application containers

Reinhard Kugler · LIVE

5:59 min

Live demonstration of vulnerability exploitation and zero trust mitigation

Jan Peer Stöcklmair Jan Peer Stöcklmair · WWC Europe 2026

4:02 min

Applying tactical security configurations to Docker container layers

Madhu Akula · LIVE

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
about 1 month ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
about 1 month ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
about 1 month ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
about 1 month ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
about 1 month ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
about 1 month ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi
Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

Red Teaming Your LLM App -- A Hands-On Threat Model You Can Reuse

Saloni Garg

Senior ML Engineer at Adobe

Saloni Garg

Related videos

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
WWC 2025 • 12 months ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

One Pipeline, Three Regulator - SBOM Compliance for the Developer thumbnail
28:29
WWC Europe 2026 • about 1 month ago

One Pipeline, Three Regulator - SBOM Compliance for the Developer

Marcus Ross

Securing your application software supply-chain thumbnail
28:27
WWC 2022 • about 4 years ago

Securing your application software supply-chain

Niels Tanis

A practical guide to writing secure Dockerfiles thumbnail
42:25
LIVE • over 5 years ago

A practical guide to writing secure Dockerfiles

Madhu Akula

From Build to Breach: Hacking Kubernetes Through the Supply Chain thumbnail
31:38
WWC Europe 2026 • about 1 month ago

From Build to Breach: Hacking Kubernetes Through the Supply Chain

Ali Alp

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.