Signed images are available, but evidence still sits with one platform security engineer.
Application teams need a fast path to use trusted images, while the platform group must keep its approval standard intact.
Who you’d be doing this for
“Three release managers asked me for the same provenance evidence today, and I’m still answering tickets.”
Carolina Santos · Platform Security Engineer
Owns image policy and fields evidence requests from application teams using Kubernetes.
What is at stake
Only 18 of 70 intended application teams are using signed images in production. You must weigh faster adoption against keeping the platform security team’s evidence standard intact.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- faster application adoption vs. consistent evidence standards
- reusable guidance vs. customer-specific workflows
- support responsiveness vs. self-sufficient adoption
- renewal proof vs. meeting fatigue
Why Chainguard
Chainguard Images provide signed images and attestations, so adoption stalls when customers cannot translate those artifacts into everyday release evidence.
Written with these in mind
Not your kind of problem? 18 more at Chainguard, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.