Container image supply

OCI descriptors identify referenced content using a media type, size, and digest. The digest provides a content identity that can be checked against retrieved bytes. A registry tag is a convenient name whose target may change; recording a digest makes a deployment's selection explicit. For a multi-platform artifact, also record the image index and selected platform manifest so an incident investigation can identify what actually ran on a particular architecture.

Build once, verify the resulting identity, and promote that identity across environments. Rebuilding from the same source revision may still produce different bytes because dependencies, timestamps, or toolchains changed. This does not make reproducibility impossible; it means the build inputs need their own identities and controls. Keep a release record connecting source, builder, dependency evidence, image digest, and deployment. A successful smoke test on one digest is not evidence about a later tag target.

Signature verification must connect the artifact to an expected signer or workload identity and the appropriate trust root. With identity-based signing, an arbitrary valid certificate is insufficient: constrain the identity and issuer that your release policy recognizes. A signature can establish that an accepted identity signed an artifact assertion. It cannot establish that the application has no vulnerabilities, that its source was reviewed, or that the signer's environment was uncompromised.

Provenance adds evidence about how an artifact was produced, while a software bill of materials records a particular inventory. Their value depends on the producer, completeness, and validation policy. Write admission rules as specific questions: was the artifact built by the protected release workflow, from an approved source, with acceptable evidence? Give emergency exceptions a narrow scope and expiry. Test both a rejected artifact and an accepted one, because a policy that only runs in audit mode may create reassuring logs without enforcing the release boundary.

A registry outage can block replacement even when existing replicas continue running. Model cold starts, regional caches, and rollback artifacts as part of deployment availability. An immutable local cache reduces repeated transfer, but eviction or a new node can expose the dependency again. Retain the previous approved digest and its evidence for the operational rollback horizon, then test recovery on an empty machine instead of only on warm developer hosts.

Use a small transfer model to distinguish artifact size from fleet-wide downloads. Shared immutable layers can be reused on a node when the runtime's content store retains them. This is a capacity opportunity, not a guaranteed cache hit. A platform should measure actual cold-pull duration, registry errors, and disk pressure. Deleting old layers without knowing which rollback depends on them trades a visible storage saving for an unmeasured recovery risk.