What's in your Container? Securing the Software Supply Chain without Slowing Down

How do we secure massive, complex supply chains without slowing your developers down to a crawl? This talk provides a simple preview to Red Hat's Trusted Software Supply Chain, based on three pillars: Transparency through the Trusted Profile Analyzer; Identity, thanks to the Trusted Artifact Signer; and Guardrails, with the Advanced Cluster Security for Kubernetes.

Talk presented at the 2026 Red Hat Summit Connect Switzerland event in January 14th, 2026.

Video available: https://www.youtube.com/watch?v=IjO95cHLzNY

Transcript

1. Securing the Software Supply Chain without Slowing Down What’s in your Container? Adrian Kosmaczewski Senior Architect Red Hat
2. Adrian Kosmaczewski Senior Architect Red Hat
3. Act 1 The "Black Box" Problem
6. Software is assembled, not written
7. https://static.carahsoft.com/concrete/files/1617/1597/8665/2024_Open_Source_Security_and_Risk_Analysis_Report_WRAPPED.pdf
8. Speed
9. “Typosquatting” “requessts”
12. Do you know what is running in your infrastructure?
13. We need the digital equivalent of a nutrition label
14. Act 2 The Three Pillars
16. Transparency, Identity, and Guardrails
17. 1. Transparency
18. SBOM
19. (Software Bill of Materials)
20. https://github.com/anchore/syft
21. https://developers.redhat.com/products/trusted-profile-analyzer
22. 22 https://github.com/CycloneDX/bom-examples/blob/master/SBOM/keycloak-10.0.2/bom.json
23. 2. Identity
26. 26 https://www.sigstore.dev/
27. https://developers.redhat.com/products/trusted-artifact-signer
30. 3. Guardrails
32. https://www.redhat.com/en/technologies/cloud-computing/openshift/advanced-cluster-security-kubernetes
33. Container built on developer laptop?
35. Container signed with the key of another department?
37. Container image built and signed by the trusted application pipeline?
39. Fundamental Shift on our Security
42. Act 3 The Architecture of the Factory Floor
47. 47 $ podman build -t quay.io/developer/some-image . $ podman push quay.io/developer/some-image $ oc new-app quay.io/developer/some-image
48. Conclusion
49. Trust.
50. Security ≠ “Department of No”
51. Trusted Software Supply Chain
53. Secure way == Easiest way
54. Sovereignty
56. linkedin.com/company/red-hat youtube.com/user/RedHatVideos facebook.com/redhatinc twitter.com/RedHat Thank you