The container delivery pipeline — end-to-end view

Container delivery is one pipeline, not six independent jobs. The source commit is the input; the deployed, signed, attested image digest is the output. Every stage in between consumes the artefact the previous stage produced and emits the artefact the next stage expects. When a stage is skipped, the artefact that should bind two stages together is missing, and the chain of trust breaks at that link.

The pipeline as a chain

flowchart LR
    A["Source commit"] --> B["Test (lint, unit, integration)"]
    B --> C["Build (BuildKit)"]
    C --> D["SBOM (syft)"]
    C --> E["Vuln scan (trivy)"]
    D --> F["Sign (cosign)"]
    E --> F
    F --> G["Registry (digest)"]
    G --> H["Deploy (GitOps)"]

Six stages, eight arrows, two scan branches that converge at signing. The chain is linear except for the SBOM and vulnerability branches that both feed the signature. The output of every stage keys off a single identifier: the source commit SHA, propagated as ${COMMIT_SHA} through the pipeline.

The chain produces four durable artefacts that outlive the CI run:

• The image digest - the content-addressed blob in the registry.
• The signature - a signed claim over the digest.
• The SBOM attestation - the inventory of what is in the image.
• The vulnerability report - the snapshot of known CVEs at build time.

The four are stored together at the same digest and consumed together by the admission controller and the GitOps controller.

What each stage consumes and produces

A stage that does not consume the previous stage’s output is a stage that is silently disconnected. A docker build step that runs even when tests are red is a step that has lost the chain. A cosign sign step that runs even when the vuln scan finds a critical CVE is a step that has lost the chain.

Where the chain of trust begins and ends

The chain begins at the source commit. The commit SHA is the provenance root: every later artefact can be traced back to it through the registry entry, the signature, and the attestations. The chain ends at the cluster, when the kubelet pulls the digest and the admission controller has verified the signature. Two endpoints, one chain.

flowchart LR
    A["Commit 8a3f9d2 (provenance root)"] --> B["Image sha256:8a3f..."]
    B --> C["Signature"]
    B --> D["SBOM"]
    B --> E["Vuln report"]
    C --> F["Admission controller verify"]
    D --> F
    E --> F
    F --> G["Pod runs (chain end)"]

A break at any link collapses the chain. A signature that cannot be verified against the OIDC subject collapses at the admission controller. An SBOM that does not match the digest collapses at the audit step. A vuln report that has been silently skipped collapses at the next CVE publication.

Failure modes when stages are skipped

The four most common failures, by stage:

• Skip test. A green build of red code. The image compiles, the pods start, the regression surfaces in production.
• Skip scan. A green image with a known critical CVE. The CVE is published after the build; without a scan, the image has no record of what was known at build time.
• Skip sign. A green image with no chain to anything. A developer can later re-tag it; nothing prevents substitution.
• Skip pin by digest. A green image that is referenced by tag. The tag moves; the next render pulls a different blob.

Production discipline

1. Propagate ${COMMIT_SHA} through every stage. A stage that cannot name its inputs cannot be reproduced.
2. Fail the pipeline on any missing attestation. A green image with no signature is a failed image, not a passing one.
3. Treat the registry as the chain endpoint, not the cluster. What reaches the registry is what can be audited; what reaches the cluster is one sync later.
4. Re-run on signature failure, not on signature success. A signature that succeeded but did not include the SBOM is partial.

Cross-course references

• Containers for Production Sysadmins - Parts XI-XIV cover image supply chain mechanics; this part is the pipeline that drives them.
• Sigstore project - the broader Sigstore documentation covers Fulcio, Rekor, and cosign in detail.
• This course, Part LIII (ContainerSupplyChain) - lessons git-cicd-gitops-liii-01 through git-cicd-gitops-liii-06 cover the individual stages; this part wires them into one pipeline.

Quiz