Dockerize Java Securely: SBOMs + Attestations + Cosign
Containerizing Java applications is easy. Containerizing them securely is not. This talk shows how to strengthen Java Docker builds with SBOMs extracted at every stage of a multi-stage build, BuildKit attestations, OCI 1.1 referrers, Docker Hardened Images, and Cosign signing — told through the narrative of the Docker Commandos in Asgard.
Delivered at BaselOne 2026 in the Markthalle Basel, Switzerland.
This session brought the Docker Commandos to a Java audience, walking through SBOM generation at every stage of a multi-stage build, BuildKit attestations, OCI 1.1 referrers, Docker Hardened Images, and Cosign signing — with a live demo containerizing a Spring Boot app securely from the start.
Invite Me to Speak
Available for conferences, workshops, corporate training, and meetups. I can present remotely or travel to your event.