When to run this
Run it in the hour before a production deploy, and again after any
change to the registry, its certificate, its credentials, or the
daemon’s registry-mirrors and insecure-registries settings. It
takes about 25 minutes the first time and under five once the
variables are in a file.
How to run it
Every command expects a few variables. Set them once, in the shell you will run the deploy from:
REGISTRY=registry.example.com
REPOSITORY=platform/api
IMAGE="$REGISTRY/$REPOSITORY@sha256:REPLACE_ME"
PREVIOUS_IMAGE="$REGISTRY/$REPOSITORY@sha256:REPLACE_ME"
EXPECTED_IDENTITY='https://github.com/example-org/api/.github/workflows/release.yml@refs/heads/main'
EXPECTED_ISSUER='https://token.actions.githubusercontent.com'
Run every command on the deploy host, as the user the deploy runs
as. This is the whole point of the checklist. Docker reads
credentials from $HOME/.docker/config.json, so running the
credential checks as yourself when the deploy runs as root, or under
a systemd unit with a different HOME, verifies a file the deploy
will never open. sudo -u deploy -H ... if that is who deploys.
The daemon-configuration items read /etc/docker/daemon.json. On a
host with no such file, jq exits non-zero — read that as “no mirror
configured” and “no insecure registries configured” respectively,
which is a pass for one item and a finding for the other.
Reading the results
Several commands are written so that no output means pass:
digest-pinned, no-latest-tag, credentials-not-plaintext and
no-insecure-registries all print only the things that are wrong. If
one of them prints a line, that line is the finding. Do not run them
and skim for something reassuring — there is nothing reassuring to
find, by design.
Evidence and sign-off
Paste the output of the critical items into the change record. The
two that matter most in a post-incident review are
rollback-image-exists and signature-verified: the first is the one
teams discover they skipped at the exact moment they need it, and the
second is the only one that proves the artefact you are about to run
is the artefact your pipeline built.
- Operator: _________________ Date: ___________
- Reviewer: ________________ Date: ___________