Define approved base image policy and governance
Implementation Effort: Medium – Curating approved base images, maintaining a private registry with a rebuild cadence, and configuring admission-control policies requires coordination between security and platform teams. User Impact: Medium – Teams that build containers must switch to approved base images and update their Dockerfiles, so that subset of developers is affected. Lifecycle Stage: Build
Overview
Define and enforce an approved base image policy so teams build containers from reviewed, hardened images that the organization can maintain and trust.
Every container starts from a base image, and that base image carries its operating system packages, libraries, and default configurations into production. When development teams freely choose base images from public registries like Docker Hub, they introduce an uncontrolled supply chain dependency that can include unpatched vulnerabilities, unnecessary packages, or malicious content. An approved base image policy establishes a curated set of verified images that teams must use as their starting point.
The governance model around base images is as important as the images themselves. Organizations should maintain approved images in a private registry such as Azure Container Registry, rebuild them on a regular cadence to incorporate security patches, and continuously assess them with Microsoft Defender for Cloud container security capabilities.
For AKS, enable the Azure Policy add-on for Kubernetes and apply built-in policies such as restricting containers to allowed registries so admission control enforces registry restrictions at deploy time. Microsoft Defender for Containers gated deployment is generally available for supported Kubernetes environments (including AKS, EKS, and GKE) and uses image vulnerability findings to make admission-time decisions. Configure it to audit or deny vulnerable deployments at admission time, and pair it with production-ready Azure Policy controls such as allowed images or allowed registries to enforce the base image boundary, treating gated deployment as a complementary vulnerability-based signal alongside policy-based registry governance.
Without an approved base image policy, organizations face an ever-expanding vulnerability surface that compounds with every new deployment. Each team selecting its own base image means different patch levels, different operating system distributions, different default configurations, and no centralized way to respond when a critical vulnerability is disclosed in a commonly used image layer. A governed base image catalog transforms that response from a manual, repository-by-repository hunt into an automated query against a known, controlled set of images. By requiring teams to build only from reviewed, verified base images enforced through admission control, this task supports Verify explicitly and Assume breach.