CI/CD Fundamentals · Module 09 of 12

Container builds, registries and provenance

Treat container images as immutable delivery artifacts, use meaningful tags/digests and understand the role of provenance.

Learning objectives

By the end of this module, you should be able to:

Separate image build from deployment.
Prefer immutable digests or source-specific tags for promotion.
Explain why provenance and attestations complement, rather than replace, tests.

An image is a delivery artifact

Build the container image once from a validated source revision, scan/test it as appropriate and promote the same image identity. Rebuilding the image for each environment defeats build-once promotion.

Tags are names; digests identify content

A mutable tag such as latest can move. A content digest identifies specific image content. Release processes should preserve an immutable reference even if human-friendly tags are also used.

Provenance connects artifact and build process

Artifact attestations can record verifiable information about where and how an artifact was built. They strengthen supply-chain evidence but do not prove the software is bug-free or secure by themselves.

Worked examples

See the idea in practice.

Image identity model

source commit -> build -> image:git-<sha> -> digest sha256:... -> staging -> production

The same digest should move through environments.
Human-friendly tags can point to that immutable content.

Hands-on lab

Lab — Model immutable image promotion without a registry

Goal: Create a fake image manifest, hash it and promote the digest rather than a mutable label.

STEP 1

Create image metadata

mkdir -p ~/gnu-cicd-labs/module09 && cd ~/gnu-cicd-labs/module09
printf 'base=runtime-v1\napp=build-42\n' > image.manifest

STEP 2

Calculate digest

DIGEST=$(sha256sum image.manifest | awk '{print $1}')
printf '%s\n' "$DIGEST" > image.digest

STEP 3

Create environment references

cp image.digest staging.digest
cp staging.digest production.digest

STEP 4

Verify same identity

cmp image.digest staging.digest && cmp staging.digest production.digest

Verify

The staging and production references contain the same digest.
Changing image.manifest changes the calculated digest.

Expected outcome

Promotion references immutable content identity.

If it fails

Do not compare only mutable tags when proving artifact identity.
A real registry digest is produced by the registry/image manifest system; this lab models the principle locally.

Real-world connection

Digest-aware delivery makes rollback and forensic analysis deterministic.

Avoid these traps

Common mistakes

Deploying latest with no immutable reference recorded.
Rebuilding the container separately for each environment.
Treating provenance as a substitute for tests and vulnerability management.

Knowledge check

Can you explain it without looking back?

Open each answer only after you have tried to answer the question yourself.

1What is more immutable: a tag or an image digest?

The content digest identifies specific image content; a tag can be moved to different content.

2Should production rebuild an image that already passed staging?

No. Prefer promoting the same validated image identity.

3What does provenance add?

Evidence about the artifact's build origin/process; it does not guarantee defect-free software.

My Learning

Record your progress for this module.

Progress is saved in this browser immediately. When you sign in to My Learning, it can also sync across devices.

Not started

Core lab attemptedRecord this after meaningfully completing or attempting the module's core lab.Knowledge checks attemptedThis is marked automatically after you open every answer in the module; you can also record it manually.

Attempt the core lab and knowledge checks before marking the module complete.