Signing Container Images With Sigstore

This post started as a note to my future self. Every few months I relearn the same lessons about least privilege, so this time I'm writing them down.

When we finally measured, the numbers were worse than anyone guessed. Around 36% of the time spent on a typical change went into working around least privilege rather than building anything.

Some background

Most of the complexity was accidental. Over the years we'd layered three different approaches to least privilege on top of each other, and each one made sense at the time.

The setup was ordinary: Sigstore at the edges, Semgrep doing most of the heavy lifting, and a handful of scripts nobody wanted to own. It worked well until usage roughly doubled over a single quarter.

Trying something different

The key insight was to treat least privilege as part of the interface rather than an implementation detail. Once we did that, most of the other decisions followed naturally.

The core of it looks like this:

Content-Security-Policy: default-src 'self';
  script-src 'self' 'nonce-r4nd0m';
  style-src 'self';
  img-src 'self' data:;
  frame-ancestors 'none';
  base-uri 'self'

Nothing about this is clever, and that's the point. Anyone on the team can read it in a minute and know exactly what it does.

A few things that helped along the way:

• Delete dead code aggressively; it's the cheapest refactor there is.
• Pair on the first few changes so the knowledge doesn't live in one head.
• Keep the old path around until the new one has survived a real incident.
• Make the default the safe choice, not just the documented one.

What it cost us

None of this is free. The new approach is a bit more verbose, and newcomers occasionally ask why we don't just use Vault for everything. That's a fair question with a boring answer: we tried, and it made least privilege harder to reason about.

The biggest cost was social, not technical. Changing how people think about least privilege takes much longer than changing the code.

Closing thoughts

I don't think there's a universal answer here, but I hope this gives you a few ideas to try on your own project. If you do, I'd love to hear how it goes.