Dockerize Java Securely: SBOMs + Attestations + Cosign
Containerizing Java applications is easy. Containerizing them securely is not. This talk shows how to strengthen Java Docker builds with SBOMs extracted at every stage of a multi-stage build, BuildKit attestations, OCI 1.1 referrers, Docker Hardened Images, and Cosign signing — told through the narrative of the Docker Commandos in Asgard.
Talk Deliveries
Containerizing Java applications is easy. Containerizing them securely is not.
In this talk, Mohammad-Ali A'râbi introduces the Docker Commandos and their mission to defend Asgard from CVE monsters, using a Java build as the practical target.
Instead of generating a single SBOM at the end of the build, the session shows how to extract an SBOM at every stage of a multi-stage Dockerfile — catching vulnerabilities that would otherwise slip through in discarded build stages.
Key Security Pillars
- Why SBOMs are critical for modern Java applications — and why one SBOM at the end of the build isn't enough.
- SBOM generation integrated directly into Docker builds — multi-stage, not just the final image.
- BuildKit attestations and OCI 1.1 referrers — attaching cryptographically signed metadata that travels with the image across registries.
- Docker Hardened Images — CVE-free, open-source base images that shrink the inherited attack surface.
- Cosign signing — asking Johnny Cage to sign the images and their SBOM attestations.
Live demo: containerizing a Spring Boot app with security built in from the start. Attendees can later try the same mission as a DIY labspace.
The talk uses a unique mythological narrative to make complex DevSecOps concepts accessible and memorable.