What is Image signing?

Container image signing is the process of applying a cryptographic signature to a container image so teams can verify who published it and whether it changed after release.

In containerized environments, images often move through registries, CI/CD pipelines, Kubernetes clusters, and multiple cloud services before they run in production. Image signing helps protect that chain by proving image integrity and publisher identity before deployment.

How container image signing works

Image signing uses public key cryptography. A trusted publisher signs an image, usually by signing its digest rather than the image name or tag. The digest is a unique hash of the image content, so even a small change creates a different value.

When a system pulls or deploys the image, it checks the signature against a trusted public key, certificate, or identity. If the signature is valid and the image matches the signed digest, the image can be trusted based on the organization’s policy.

Why it matters in DevSecOps

Containers are frequently rebuilt and redeployed, which makes manual trust checks unrealistic. Container image signing gives security and platform teams a repeatable way to verify software provenance without slowing delivery.

It helps reduce risks such as:

• Running images from untrusted publishers
• Deploying tampered images from a compromised registry
• Using outdated or unapproved builds in production
• Losing visibility into what was promoted through the pipeline

Image signing is especially valuable when paired with software bills of materials, vulnerability scanning, admission controls, and policy-as-code. Together, these controls help enforce that only verified, compliant images reach runtime environments.

Where container image signing fits

Image signing usually happens after a container image is built, scanned, and approved. The signed image is then pushed to a registry and verified later during deployment.

In Kubernetes environments, admission controllers can block unsigned images or images signed by an unknown identity. In enterprise device and endpoint ecosystems, platforms such as Hexnode can complement this approach by helping enforce broader security posture, access, and compliance policies across managed endpoints that interact with cloud-native services.

Image signing vs image scanning

Image scanning checks an image for known vulnerabilities, secrets, misconfigurations, or risky packages. Whereas image signing verifies that the image is authentic and unchanged.

Both are needed. A scanned image may still be replaced or tampered with later. A signed image may still contain vulnerabilities if scanning and approval were weak. Strong container security uses scanning to assess risk and signing to preserve trust.