Skip to content

Getting Started

Use this workflow when an approved Indian Hill Labs container becomes available. Product-specific release documentation takes precedence where it defines stricter requirements.

1. Select an approved artifact

Start with the Container Catalog and follow the approved registry link. Confirm that the release supports the required architecture and use case. Record the immutable digest; do not rely on a tag alone for promotion or verification.

2. Retrieve assurance evidence

Obtain the evidence linked from the release record. Depending on the release, this may include:

  • SBOM and vulnerability assessment summary
  • VEX statements for analyzed findings
  • Build provenance and attestations
  • Functional and runtime security test results
  • Signature-verification instructions
  • Documented exceptions and usage constraints

Evidence must refer to the same digest as the artifact being evaluated.

3. Verify identity and integrity

Follow the release-specific artifact signing instructions. Verify the expected signer or identity, artifact digest, signature, and applicable trust policy. Treat a successful cryptographic check as one control—not as proof that the artifact is suitable for every environment.

4. Apply secure runtime constraints

Preserve the image's security posture in the deployment environment:

  • run as the declared non-root user where supported;
  • avoid privileged mode and unnecessary Linux capabilities;
  • prefer a read-only root filesystem when compatible with the workload;
  • mount only the data, secrets, and sockets the workload requires;
  • apply CPU, memory, process, and storage limits;
  • restrict inbound and outbound network paths;
  • keep secrets outside the image and inject them through an approved mechanism; and
  • retain the digest in deployment records.

Environment responsibility

A securely engineered image can be weakened by permissive deployment configuration. Orchestrator policies, host security, secret management, access control, logging, and network boundaries remain part of the consumer's security model.

5. Monitor and update

Subscribe to published security notices, track the deployed digest, and establish an update path. When an artifact is superseded, evaluate the new digest and its evidence before promotion.