Proposal: check image signatures before a sandbox starts

[sumansaurabh]

The problem

AerolVM runs whatever image a create names. It does not check signatures or attestations, so a tampered image or one from the wrong registry starts like any other.

What you can do today

Check signatures in your build pipeline, for example with cosign verify. Then pin the checked image by digest (image@sha256:...), so the sandbox runs exactly what you checked.

A starting shape

• The operator lists trusted signers in a policy file: public keys, or keyless identities through Sigstore (a public service for signing and checking software).
• Before a pull, the server checks the image's signature. With no valid signature, the create is refused and the reason is written to the audit log.
• The policy can apply to every image, or only to some registries.
• It covers each way an image reaches a sandbox: Docker, containerd, the Firecracker image builder, and WebAssembly modules pulled from a registry.

Questions for you

1. Do you sign with keys, or keyless through Sigstore?
2. Do you need checks on attestations too, such as SLSA provenance or an SBOM?
3. Should a failed check refuse the create, or only warn at first?
4. Which registries do you pull from?

How to weigh in

React with 👍 if you need this, and comment with your answers.

Want to talk it through? Book a call with the maintainer, or join the community call on the first Saturday of every month at 8 pm Pacific Time.

If your company needs this soon, you can sponsor the work. It is built in the open and ships to everyone.