Stop Running Mystery Meat in Production

We have all been there. You need a database or a quick node environment, so you throw "FROM node:latest" into your Dockerfile and deploy. It works, but you have just introduced a black box into your Kubernetes cluster. For the Developer, it’s a quick fix. For the Platform Engineer, it’s a nightmare. Most upstream images from public registries are a roll of the dice. They come pre-packed with critical vulnerabilities, unknown binaries, and bloated libraries that you didn’t ask for and definitely don’t want running in your secure environment. In a world of Zero Trust, why are we trusting random upstream maintainers with the keys to our infrastructure? In this session, we will dismantle the myth that "open source means secure" when it comes to container images. We will walk through the architecture of a truly Secure Software Delivery pipeline—one that establishes trust before a single line of code is committed. We will discuss: - The hidden dangers inside popular "official" images. - Moving beyond basic scanning: Why you need SLSA L3 provenance, SBOMs, and cryptographic attestation. - The "Build vs. Buy" dilemma: Should you curate your own base images or rely on a hardened upstream provider? Join us to learn how to bridge the gap between developer velocity and platform security, ensuring that the only thing running in your cluster is code you actually trust.