Dockerize Java Securely: SBOMs + Attestations + Cosign
Containerizing Java applications is easy. Containerizing them securely is not. This talk shows how to strengthen Java Docker builds with SBOMs extracted at every stage of a multi-stage build, BuildKit attestations, OCI 1.1 referrers, Docker Hardened Images, and Cosign signing — told through the narrative of the Docker Commandos in Asgard.
Delivered on the main stage at Jfokus 2026 in Stockholm, this talk introduced the Docker Commandos and their mission to defend Asgard.
Sweden provided the perfect backdrop for a Norse-themed security story. The session combined high-level narrative with deep technical demonstrations of SBOMs, attestations, and Docker Bake.
The "Asgard Mission" has since become the core of the Docker Commandos workshop series.
Invite Me to Speak
Available for conferences, workshops, corporate training, and meetups. I can present remotely or travel to your event.