Securing ISV-Provided Container Images

This guidance outlines best practices for securing ISV-provided container images: scan every image and integrate scanning into CI/CD, eliminate embedded secrets and excessive privileges, enforce vulnerability and license policies, label images to enable segregation and policy enforcement, verify image integrity and provenance with tools like Grafeas and Notary, and apply runtime protection and least-privilege profiles; automating these measures reduces attack surface and ensures consistent security for third-party and in-house images.