# Pathrule Pattern: Container and Image Security (1.0.0) # ::pathrule:package:container-image-security ### [RULE] Pin every image input by immutable digest (path: /deploy) Base, tool, and deployment images resolve to reviewed digests rather than mutable tags. A tag can point to different bytes between build, test, and production, invalidating review and making rollback ambiguous. Enforce this boundary in /deploy so invalid work stops before it reaches another subsystem or creates an externally visible side effect. - Keep the human-readable tag as an annotation, but make the digest the value used by builds and deployments. - Update digests through an automated change that includes upstream release notes, scan results, and rebuild impact. - Reject floating tags in Dockerfiles, compose files, build actions, and workload manifests. - Record the digest of every stage, including build-only and migration images. Verification: Re-resolve all declared tags and confirm the reviewed digest is the one built and admitted; change a tag upstream and prove deployment bytes do not drift. --- ### [RULE] Run containers with the least kernel authority (path: /k8s) Workloads drop unnecessary privileges, capabilities, writes, and host integration at admission time. A small application vulnerability becomes a host or cluster compromise when the container runs as root, writes its image, or reaches host namespaces. Enforce this boundary in /k8s so invalid work stops before it reaches another subsystem or creates an externally visible side effect. - Require a non-root user, disable privilege escalation, drop capabilities by default, and add back only reviewed needs. - Use a read-only root filesystem and explicit writable volumes for the few paths that need state. - Block privileged mode, host PID, host network, host paths, and unrestricted device access unless a security-owned exception exists. - Apply CPU, memory, process, and ephemeral-storage limits so compromise cannot become node-wide exhaustion. Verification: Deploy a deliberately over-privileged fixture and confirm admission rejects it; run the real workload under the final policy and exercise startup, shutdown, and maintenance paths. --- ### [MEMORY] A signature is useful only with an identity policy (path: /deploy) Cryptographic verification must identify the signer and the approved build context, not merely report that bytes have a signature. A valid signature proves a key or identity signed bytes, but trust comes from checking who signed, for which repository, through which builder, and from what source revision. Bind admission to the expected issuer, subject, source repository, workflow, and immutable artifact digest. Store provenance beside the image and make the deployment verify it rather than trusting a CI badge. Keep emergency unsigned admission separate, time-bound, and observable because a blanket bypass removes the value of signing. Keep the decision explicit at /deploy; moving it into an incidental caller makes behavior depend on which route happened to execute first. See /.github/workflows for provenance production and /k8s for the admission boundary. That related boundary consumes this decision and carries the evidence that proves it still holds. --- ### [SKILL] review-container-image (path: /) --- name: review-container-image description: Review one container image for provenance, contents, vulnerabilities, and runtime permissions before release. --- # Review Container Image Run this procedure whenever the governed surface changes or its operational evidence becomes stale. 1. Resolve the deployed digest and verify its signature and provenance against the approved builder, repository, workflow, and source revision. 2. Inspect layers and the final filesystem for package managers, shells, compilers, credentials, private keys, tokens, and files copied from an unintended build context. 3. Review vulnerabilities by reachable component, exploit conditions, available fix, and compensating controls instead of accepting a severity count alone. 4. Launch the image with production user, filesystem, capability, network, and resource settings; exercise health, shutdown, and maintenance behavior. Record the decision, failed checks, and follow-up owner with the change. A successful run leaves reproducible evidence that another reviewer can inspect without repeating the investigation from memory. --- ### [SKILL] refresh-container-base (path: /.github/workflows) --- name: refresh-container-base description: Refresh pinned base images with rebuild evidence, compatibility tests, and an auditable digest change. --- # Refresh Container Base Run this procedure whenever the governed surface changes or its operational evidence becomes stale. 1. Resolve the upstream release to an immutable digest and collect its changelog, end-of-support status, and published security information. 2. Rebuild without cache, generate a software bill of materials and provenance, then compare packages and image size with the current release. 3. Run application, integration, and runtime-policy tests on the candidate image, including non-root startup and read-only filesystem behavior. 4. Promote only the reviewed digest, retain the prior known-good digest for rollback, and record why any unfixed reachable vulnerability is accepted. Record the decision, failed checks, and follow-up owner with the change. A successful run leaves reproducible evidence that another reviewer can inspect without repeating the investigation from memory.