How do you secure a container image and its supply chain?
What they are really testing: Whether you think beyond "scan the image" to base image choice, runtime hardening, and provenance. Container supply-chain attacks are a growing real threat.
A real interview question
How do you secure a container image and its supply chain?
What most people say
drag me
“I would scan the image for vulnerabilities before pushing it to the registry.”
Scanning is necessary but only one layer. It ignores base image size, running as non-root, image signing, SBOMs, and admission control, which is where supply-chain security actually lives.
The follow-ups they ask next
Why pin a base image by digest instead of using :latest?
:latest is mutable, so two builds can pull different images and a compromised tag could inject malicious content. A digest is immutable and reproducible, you get exactly the image you reviewed.
What problem do image signing and SBOMs solve?
Provenance and transparency: signing proves the image came from your trusted pipeline and was not swapped; the SBOM lists every component so you can answer "are we affected?" when a new CVE drops.
What the interviewer is listening for
- Minimal/distroless base + non-root runtime
- Pins by digest, scans in CI
- Signing/SBOM/admission control for supply chain
What sinks the answer
- Only "scan the image"
- Runs as root / bakes in secrets
- No notion of provenance or admission control
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Layered: [minimal/distroless base for less attack surface], [non-root USER, dropped caps, read-only FS, no baked-in secrets], [scan in CI and pin by digest], [sign images + SBOM for provenance], and [admission policy to reject unsigned/root images]. Scanning is [one layer], not the whole answer.”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Foundation
What is the difference between authentication and authorization?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free