DevSecOps Practice Hub

Build Security

Make builds reproducible, isolated and free of untrusted inputs so outputs can be trusted.

AdvancedBuild SecuritySupply ChainInfrastructure

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Build Dependency scanning, image scanning, SBOM generation and signing.

Overview

A hardened build pins its toolchain, resolves dependencies from controlled mirrors, runs without privileged access and emits the same output for the same input.

Why it matters

If the build environment is mutable and network-open, the artefact cannot be reasoned about.

How it works

  1. 01Toolchain and base images are pinned by digest.
  2. 02Dependencies come from an internal proxy with retention.
  3. 03Builds run rootless in an ephemeral sandbox.
  4. 04Output digests and an SBOM are recorded per build.

Common tools

BuildKitKanikoSyftDockerKubernetesGitHub

Implementation examples

bashRootless image build
buildah bud --isolation chroot --pull=always -t app:$GIT_SHA .
Avoids mounting a privileged Docker socket into the CI job.

Best practices

  • Pin everything by digest.
  • Use an internal dependency proxy.
  • Tag artefacts with the commit SHA.

Common mistakes

  • Mounting the host Docker socket into build jobs.