Docker and CI/CD · Senior · Question 75 of 75

What does `docker buildx` build attestation (`--provenance`, `--sbom`) attach?

1Unit test results that the registry shows on its page
2A signed copy of the Dockerfile inside every layer
✓Correct answer: Provenance and SBOM metadata stored with the image

Explanation

Attestations are stored as extra manifests in the image index, so scanners and policies can read how the image was built and what it contains.

Further reading

Test yourself

Take the Docker and CI/CD · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.