Sheet IG-01 · Docker authorization plugin

Only sealed images run.
Signed, attested, by digest.

imagegate checks every docker run at the daemon. A container starts only if its image digest has a cosign signature from an identity you trust and a signed SPDX or CycloneDX SBOM. Dockerfiles, Compose files and run commands stay the same.

Get started How it works GitHub

$ docker run ghcr.io/acme/web:2.0 docker: Error response from daemon: authorization denied by plugin imagegate: imagegate: denied ghcr.io/acme/web@sha256:91ac… reason: NO_SBOM — no SPDX or CycloneDX attestation signed by identity "ci-main" fix: https://wiki.acme.internal/imagegate#no_sbom

Specification6 items

01

Verifies by digest

Tags resolve through dockerd to the exact digest it will run. Start re-checks the container's real image, so a moved tag can't swap it.

02

Real Sigstore

sigstore-go checks Fulcio chains, SCTs, Rekor proofs and signed timestamps, or your public keys. cosign v2 tags and v3 bundles both work.

03

SBOMs that count

A signed in-toto attestation bound to the same digest. An unsigned BuildKit SBOM is reported as untrusted.

04

Fast when warm

One verification per digest and policy. Cached starts take 1–2 ms; 200 parallel creates trigger one verification.

05

Built for rollout

Audit mode logs would-be denials. Break-glass overrides carry a ticket, expire within 7 days and alert on use.

06

Never locks you out

Only create, start and restart are gated. docker ps, info and plugin management always pass.

Verdictsevery decision has a reason

ALLOWEDsigned by an allowed identity, with a signed SBOMallow

NO_SIGNATUREno valid cosign signature for the digestdeny

IDENTITY_MISMATCHsigned, but by a fork's workflow or an unknown keydeny

NO_SBOMno signed SPDX or CycloneDX attestationdeny

SBOM_UNTRUSTEDan SBOM exists but no trusted identity signed itdeny

LOCAL_IMAGEbuilt, loaded or committed on the hostdeny

OVERRIDEbreak-glass entry with a ticket, expires within 7 daysallow

All reason codes and how to fix them →