Add container scanning and model-artifact inventory to the…

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R25 — Docker image security

   R36 — Syft & Grype SBOM/scanning

   R37 — SLSA build provenance

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Integrate container image scanning and automated CycloneDX/SPDX SBOM generation (D12) into the build pipeline. Record pinned versions/hashes for code, containers, model weights, prompts, tool schemas, and eval datasets.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Test the build pipeline with an unpinned model artifact or unapproved license/dependency and verify D12 fails the build.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Automated SBOM artifact output and build-gate failure/pass logs.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R25Docker Security Docs↗ docs.docker.com

  Daemon surface, Linux namespaces/capabilities, rootless/non-root containers, read-only FS, and secrets.

• R36Syft, Grype & Trivy (SBOM)↗ anchore.com

  CycloneDX/SPDX SBOM generation, container image scanning, dependency vulnerability detection, and scanner limits.

• R37SLSA & Sigstore↗ slsa.dev

  Supply-chain Levels for Software Artifacts (SLSA), build provenance attestations, and Cosign artifact signing.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsAnchore Open Source docs
  Getting Started

  Official walkthrough of generating a CycloneDX or SPDX SBOM from a container image or filesystem with Syft, the exact artifact D12 must emit in the pipeline.

  R36checked 2026-11-11
• videoAnchore
  One Minute Security: Build SBOM & Scan Vulns with Syft + Grype

  Shows the generate-then-scan loop on a container image (Syft for the SBOM, Grype for findings), the two-stage gate you are wiring into the build.

  R36checked 2026-11-11
• videoAnchore
  How to Generate an SBOM from Container Images Using Syft (Tutorial)

  Focuses on reading the image layer by layer to inventory OS and language packages, which explains why scanner results differ from your lockfile.

  R36checked 2026-11-11
• articleAnchore blog
  How Syft Scans Software to Generate SBOMs

  Explains the cataloger model and where detection stops, so you can state the scanner's limits honestly in the SBOM and pin what it cannot see (model weights, prompts).

  R36checked 2026-11-11
• repoAnchore (GitHub)
  anchore/syft

  The CLI and library you call in CI, with the formats and attestation options needed to attach SBOMs to images and record hashes for model and prompt artifacts.

  R36checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.