ttl.sh and cosign: Signing an anonymous & ephemeral Docker image registry.

Cloud Native Pilgrim | Kubernetes Enthusiast | Serverless Believer | Customer Experience Architect @ Pulumi | (he/him) | CK{A,AD} |
Search for a command to run...

Cloud Native Pilgrim | Kubernetes Enthusiast | Serverless Believer | Customer Experience Architect @ Pulumi | (he/him) | CK{A,AD} |
No comments yet. Be the first to comment.
GPU scheduling in Kubernetes has always felt like buying a mansion when you need a studio apartment. A small inference workload that needs 2GB of GPU memory gets scheduled on an entire 80GB A100, and there's nothing you can do about it. The device pl...

TL;DR: The code https://github.com/dirien/quick-bites Nothing is more controversial in the Kubernetes community than whether to use Helm or Kustomize. I always advocate the philosophy of using the right tool for the right job. It avoids the problem...

TL;DR Le code https://github.com/dirien/quick-bites Introduction This article is part three of my series on secret management on Kubernetes with the help of Pulumi. In my first article, we talked about the Sealed Secrets controller. The second arti...

With AWS Lambda

Disaster Recovery, Data Migration made easy!

The wonderful tweet of Civo, was the igniter for this "fast-food style" blog entry.

Can I use cosign on ttl.sh?
ttl.sh is an anonymous, expiring Docker container registry using the official Docker Registry image.
cosign is all about container signing, verification and storage in an OCI registry.
Using ttl.sh is quite easy: Just tag your image with ttl.sh, a UUID if you want to be extra sneaky, & time limit (i.e. :2h)
docker tag ghcr.io/dirien/minecraft-exporter:0.5.0-amd64 ttl.sh/minecraft-exporter:1h
Then push the image as usual:
docker push ttl.sh/minecraft-exporter:1h
The push refers to repository [ttl.sh/minecraft-exporter]
01ea7d5a809a: Pushed
bc276c40b172: Pushed
1h: digest: sha256:4d19d2c73fb4316ca0068175f3b5c07120095088bfda9bab1ede12b862a0b1d7 size: 739

Otherwise

We follow the instructions of cosign
cosign generate-key-pair
cosign sign -key cosign.key ttl.sh/minecraft-exporter:1h
Enter password for private key:
Pushing signature to: ttl.sh/minecraft-exporter:sha256-4d19d2c73fb4316ca0068175f3b5c07120095088bfda9bab1ede12b862a0b1d7.sig
After this we can verify our images, as part of our toolchain:
cosign verify -key cosign.pub ttl.sh/minecraft-exporter:1h
Verification for ttl.sh/minecraft-exporter:1h --
The following checks were performed on each of these signatures:
- The cosign claims were validated
- The signatures were verified against the specified public key
- Any certificates were verified against the Fulcio roots.
{"critical":{"identity":{"docker-reference":"ttl.sh/minecraft-exporter"},"image":{"docker-manifest-digest":"sha256:4d19d2c73fb4316ca0068175f3b5c07120095088bfda9bab1ede12b862a0b1d7"},"type":"cosign container image signature"},"optional":null}
