Container Registry Compromise: Detection and Recovery
Container registry compromise detection links authentication, manifest and tag changes, image digests, signatures, pulls, deployments, and runtime impact.
Registry compromise can change identity, availability, or distribution
Container registry compromise detection must distinguish repository names, mutable tags, immutable manifest digests, blobs, signatures, attestations, access policies, and downstream deployments. Attackers may push malicious content, retarget tags, delete or hide artifacts, alter retention, steal pull credentials, weaken scanning, or deny legitimate releases.
The OCI Distribution Specification defines APIs for manifests and blobs; content digests let clients verify received bytes. Digest verification establishes content identity, not publisher authorization or safety. A malicious but correctly hashed image remains malicious.
Scope registry control plane, identity provider, CI publishers, replication, caches, signing systems, deployment controllers, admission policy, and runtimes. The registry is one stage in software supply chain attacks, not the whole chain.
Preserve manifests, tag history, and access evidence
Capture registry, tenant, repository, tag, previous and new digest, manifest and config JSON, layer digests and sizes, media types, upload session, principal, token scope, source network, request ID, signature and attestation references, replication state, vulnerability-scan result, and every pull or deployment.
This is authored, abbreviated registry audit evidence:
{"time":"2026-11-10T16:08:12Z","action":"PutManifest","repository":"payments/api",
"tag":"prod","old_digest":"sha256:11aa...","new_digest":"sha256:9f42...",
"principal":"ci-release","source_ip":"198.51.100.18","signature_verified":false,
"request_id":"reg-7c1..."}
Preserve raw manifests before tags move again. Tags are pointers; the previous bytes may still exist by digest, be retained in replication, or already be running in a cluster.
Detect unauthorized publication and downstream pull behavior
Alert on new registry administrators, policy or retention changes, disabled scanning, anonymous access, token scope expansion, pushes outside release automation, tag movement after promotion, deletion of signed artifacts, signature or provenance mismatch, and replication from unexpected sources.
Join build run, immutable commit, runner identity, OIDC claims, manifest digest, signature, registry event, admission decision, deployment revision, node pull, and runtime image ID. A tag change becomes consequential when a deployment pulls or restarts on the new digest.
Emergency releases and garbage collection can look destructive. Strong findings connect an unauthorized principal or build gap to changed content and deployment. Include self-hosted CI runner compromise when the publisher itself may be untrusted.
Freeze mutation, preserve content, and stop untrusted deployment
Restrict pushes and administrative changes while preserving pull access only if verified production continuity requires it. Revoke compromised tokens and sessions, rotate publisher credentials, preserve audit and manifests, and snapshot relevant registry metadata according to provider support.
Block affected digests at admission and deployment, pause automatic rollouts, identify every cluster and host that pulled them, and quarantine running workloads when behavior is suspicious. Restore approved tags from verified digests; do not rebuild trust by reusing a mutable tag name alone.
Reproduce artifacts in a trusted build environment, verify build provenance and artifact signing, inspect downstream credentials and data, and repair registry policy, CI identity, or signing controls that were compromised.
Enforce immutable promotion and verified deployment
Separate push, pull, delete, administration, signing, and replication permissions. Use short-lived workload identity, dedicated release repositories, protected tags, retention, independent audit export, and multi-party approval for destructive operations.
Deploy by digest. Require verified signatures and provenance tied to approved builders and repositories; define admission behavior for missing evidence and outages. The Kubernetes image management documentation explains tag, digest, pull policy, and image pull behavior, but cluster policy must enforce your trust model.
Strict immutability can complicate rollback and garbage collection. Pilot promotion paths, retain known-good digests, and test registry outage behavior before enforcement.
Trace one release from commit to running image ID
Next step: choose one non-production service and record commit, build run, builder identity, manifest digest, signature, registry event, tag history, admission decision, deployment revision, and runtime image ID. Confirm every stage uses the same digest.
Move a test tag through an authorized promotion and verify alerts, without replacing production content. The durable control is immutable content identity, attributable publication, verified admission, and an inventory that can locate every running instance of a suspect digest.
Frequently asked questions
Does pulling an image by digest prevent registry compromise?
It prevents a changed manifest from silently replacing that exact digest reference, but it does not prove the original image was trustworthy, protect credentials, or stop denial, deletion, or compromise of deployment configuration.
Is a changed container tag proof of malicious activity?
No. Tags are commonly mutable during legitimate release workflows. Investigate who changed the tag, which digest it referenced before and after, whether policy allowed it, and what pulled or deployed the new content.
