Skip to content

docs: add basic security section #328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+16 −2
Open

docs: add basic security section #328

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,9 @@ and [`ClusterImageCatalog-bookworm.yaml`](Debian/ClusterImageCatalog-bookworm.ya
manifests, please migrate to the new catalogs as soon as possible. These legacy
manifests are deprecated and will be removed along with the `system` image.

## Build Attestations
## Security

### Build Attestations

CNPG PostgreSQL Container Images are built with the following attestations to
ensure transparency and traceability:
Expand All @@ -216,7 +218,7 @@ docker buildx imagetools inspect <IMAGE> --format "{{ json .SBOM.SPDX }}"
This command outputs the SBOM in JSON format, providing a detailed view of the
software components and build dependencies.

## Image Signatures
### Image Signatures

The [`minimal`](#minimal-images) and [`standard`](#standard-images) CloudNativePG container images are securely signed using
[cosign](https://github.com/sigstore/cosign), a tool within the
Expand All @@ -239,6 +241,18 @@ cosign verify IMAGE \
--certificate-oidc-issuer="https://token.actions.githubusercontent.com"
```

## Image Scanning in CI/CD

To further strengthen the security of our container images, we perform
automated image scanning as part of our CI/CD workflows. These scans help
ensure that our images adhere to best practices and remain free of known
vulnerabilities before they are published or deployed:

- **Dockle**: Verifies configuration best practices for container images. Runs
during the build stage; critical failures can block the build.
- **Snyk**: Detects vulnerabilities in OS packages, libraries, and dependencies
within the container. Runs after image build.

## Building Images

For detailed instructions on building PostgreSQL container images, refer to the
Expand Down