Beyond SBOMs: The Future of Container Supply Chain Security

The Black Forest Commandos framework + how to defend yourself against the newly emerged lineage of Shai Hulud and Mini Shai Hulud.

Transcript

1. Whose Day is It?
2. Odin’s Day Thor’s Day Frigg’s Day
3. Whose Day is It? Odin’s Day Thor’s Day Freya’s Day
4. Whose Day is It on Tuesday?
5. Whose Day is It on Tuesday? Tyr
10. Beyond SBOMs Mohammad-Ali A’râbi WAD, Berlin, Switzerland v1.1.0 The Future of Container Supply Chain Security
11. Mohammad-Ali A’râbi Software Engineer @ JobRad Docker Captain Author of “Docker and Kubernetes Security” Books: DockerSecurity.io LinkedIn, Twitter, Medium: @aerabi BlueSky, website: aerabi.com
12. Let’s fight CVEs together
13. CVE Common Vulnerabilities and Exposures They lurk in the shadows, awaiting an opportunity to attack! Which CVEs do you know?
14. CVE Common Vulnerabilities and Exposures They lurk in the shadows, awaiting an opportunity to attack! Meet: - React2Shell CVE-2025-55182 - Log4Shell CVE-2021-44228
15. Log4Shell Log4Shell was a zero-day vulnerability discovered in November 2021. In early 2022, everyone was talking about SBOMs .
16. SBOM Software Bill of Material is a list of all of the packages on a Docker image. It became more popular after the Log4Shell incident. Docker added the SBOM CLI plugin in mid 2022.
17. September 1st, 2022 Docker announced the SBOM CLI plugin Docker Community All Hands September 29th, 2022 Docker Meetup Black Forest SBOM: What’s the Hype About?
18. $ docker sbom <image> This command is available on Docker Desktop. For Docker CE, you need to install sbom-cli-plugin. The SBOM CLI plugin basically runs Syft.
19. $ docker scout sbom <image> Just to see: --format list To save it: docker scout sbom <image> --format spdx --output <file>
25. Docker Scout 1 Send a squad to scout the region
27. $ docker scout cves <image> Checks the Docker image for CVEs. Will use SBOM attestations if available.
28. SBOM Attestations 2 What are attestations?
31. $ docker buildx build --sbom=true -t <image> . This command builds the image and generate SBOM. The SBOM attestation is pushed with the image by setting the --push flag.
32. FROM ubuntu:latest AS build RUN apt-get update && apt-get install -y build-essential WORKDIR /app COPY hello.cpp . RUN g++ -o hello hello.cpp -static # -------------------- FROM scratch COPY --from=build /app/hello /hello CMD ["/hello"]
33. FROM ubuntu:latest AS build ARG BUILDKIT_SBOM_SCAN_STAGE=true RUN apt-get update && apt-get install -y build-essential WORKDIR /app COPY hello.cpp . RUN g++ -o hello hello.cpp -static # -------------------- FROM scratch COPY --from=build /app/hello /hello CMD ["/hello"]
34. - name: Build and push uses: docker/build-push-action@v6 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} cache-from: type=gha cache-to: type=gha,mode=max
35. - name: Build and push uses: docker/build-push-action@v6 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} cache-from: type=gha cache-to: type=gha,mode=max provenance: mode=max sbom: true
36. Selfie Say CVE!
38. Norse runes A B C D E F G H I J K L M N O P R S T U TH Y Z EE U
39. Hardened Images 3 How hard can it be?
41. DHI Docker Hardened Images are a set of near-zero-CVE that were open-sourced in December 2025. These images are available for dev (installation stages) and production (final stage of a production image).
42. # Not hardened FROM node:24 AS build # For build stage FROM dhi.io/node:24-dev AS build # For production stage FROM dhi.io/node:24 Guess what’s the CVE difference?
43. # Not hardened FROM node:24 AS build # For build stage FROM dhi.io/node:24-dev AS build # For production stage FROM dhi.io/node:24 Node 24 has 9 high CVEs, 17 medium, and 169 low. DHI Node has 8 low CVEs. 95% fewer CVEs 95%
44. Learn more: ContainerSecurity.dev/blog
45. Exempted CVEs 4 Some CVEs are harmless
47. VEX Attestations 5 The attestations of being useless
50. vexctl create \ --author="mohammad-ali@aerabi.com" \ --product="pkg:docker/$IMAGE" \ --subcomponents="pkg:deb/debian/openssl@x"\ --vuln="CVE-2026-28390" \ --status="not_affected" \ --justification="vulnerable_code_not_in_ execute_path" \ --file="CVE-2026-28390.vex.json" docker scout attestation add \ --file CVE-2026-28390.vex.json \ --predicate-type https://openvex.dev/ns/v0.2.0 \ $IMAGE
51. The Signature 6 Here is Evie
53. OCI Referrers 7 You need a referral letter for the MRI
54. docker buildx build \ --sbom=true \ --output type=local,dest=out . cosign attest \ --type spdxjson \ --predicate out/sbom-build.spdx.json \ --key cosign.key \ $IMAGE
55. oras discover dhi.io/node:25 \ --platform linux/amd64 To check hardened images using Oras, first you need to log into Docker Hub account.
56. The Zero-Day 0 Count from zero
60. Let’s Dance! II.0 Zumba, rumba, or salsa?
62. SLSA v1.2 Build Track L1. Provenance exists Builds don’t influence each other. Sign key is not accessible in build steps. Provenance is generated Build is done on a hosted environment, provenance is generated and signed L2. Hosted build platform L3. Hardened build slsa.dev
63. docker buildx build \ --sbom=true \ --attest type=provenance,mode=min,version=v1 . On min: • Build timestamps • Build materials • Source repository and revision • Build platform On max: • The Dockerfile • Exact steps taken to build the image
64. If sorrow gathers to overwhelm the hearts of lovers, The cupbearer and I will unite to dismantle its very foundations. —Hafez, the Lissan al-Ghayb (1315–1390)
66. Shai Hulud There are 1.0, 2.0, and Mini Shai Hulud. Self-propagating worm compromising pre-install and post-install script.
68. November 2025 Uses preinstall instead of postinstall September 2025 Autonomous, harvests PATs and API keys Shai Hulud 2.0 Shai Hulud 1.0 $ npm ci --ignore-scripts
70. Mini Shai Hulud So cute and tiny! 29th of April. Compromised SAP Cloud Application Programming. Targets coding agents and IDE lifecycles.
72. How to Kill a Shai Hulud?
73. $ sbx run claude Docker Sandbox puts your AI agent in a microVM and doesn’t give it access to the tokens.
74. TanStack Poisoning CI cache poisoning! May 11th, 2026. The worm is blocking sunshine, you can’t get tanned. Rendered SLSA level 3 insufficient.
76. Miasma Wave 1 June 1st The worm of Shai Hulud family compromised 32 packages in @redhat-cloud-services namespace.
78. Miasma Wave 2: Phantom Gyp June 3rd Exploits the gyp binding. Bypasses --ignore-scripts.
80. Checklist Put your AI coding agents into a Sandbox Implement SLSA L3 to protect your keys Use pinned dependencies Use keyless signing to avoid stolen keys Have a cool-down period before installing Disable lifecycle scripts by default Harden Build Pin Your Version Cool Down Don’t Trust AI Short-Lived Key Disable Scripts
81. Checklist When the next React2Shell happens, you need to delete caches, rebuild, redistribute, and act fast Have an Incident Playbook
82. Outro # Get out! —Arnold Schwarzenegger
83. REDDUCK2026 at: ContainerSecurity.dev 50%
86. buy.DockerSecurity.io Slides DKS BFS Comic
87. CREDITS: This presentation template was created by Slidesgo , and includes icons by Flaticon , and infographics & images by Freepik Thanks! Do you have any questions? aerabi@gmx.de aerabi.com
88. The duality between Thor and Loki His hand can hold swords or big jars of beer Bravery Attribute Effective against giant serpents, but not CVEs Hammer, Mjolnir Jfokus organizer also gave me horns Cunning and malice Green cloak is also very useful in dark forests Defender of Asgard Loki can shapeshift and turn into Jfokus speaker Ability to transform The gods is with small G, so lesser gods like Baldur. Deceiver of gods