Cosign Archives

Deploy Harbor on Docker: Self-Host a Secure Private Container Registry with Trivy and Image Signing for Your HomeLab

October 19, 2026

Say goodbye to Docker Hub rate limits. Deploy Project Harbor on Docker Compose with automated Trivy vulnerability scanning and Cosign image signing for your HomeLab.

Security

Securing Private Container Registries with Harbor: Automated Vulnerability Scanning, Cosign Signing, and Deployment Enforcement

October 12, 2026

A private registry alone won't keep vulnerable containers out of production. Without automated gates, unvetted base layers and tampered tags slip right through. Here is how Harbor combines Trivy scanning, Cosign digital signatures, and strict pull-prevention policies to lock down your supply chain.

DevOps

Container Image Signing and Verification with Cosign (Sigstore) in Kubernetes: A 6-Month Production Review

October 5, 2026

A practical 6-month review of signing container images with Cosign and Sigstore across 45+ Kubernetes microservices. Compare Notary vs Cosign, avoid registry cleanup pitfalls, and enforce image validation with Kyverno.

DevOps

Building a SLSA Pipeline for Container Applications: Securing Your Software Supply Chain from Source to Registry

June 18, 2026

Supply chain attacks target your build pipeline, not just your app code. This guide walks through implementing SLSA Level 2–3 for container images using Cosign, sigstore keyless signing, and GitHub Actions provenance generation — with real workflow examples and Kubernetes policy enforcement.

Security

Stop Trusting Tags: Secure Your Container Supply Chain with Cosign

April 29, 2026

Container tags are easily spoofed. Learn how to use Cosign and Sigstore to sign your images and protect your Kubernetes clusters from supply chain attacks.