Container Registry and Software Supply Chain Platform  ·  View 27 of 33  ·  5 · Operations

The Operator Loop

The weekly cycle that turns a violation count into a fixed image, and closes.

Editable source SVG draw.io All views
Measure workloads in violation Triage blocked or running? Remediate rebuild on patched base Re-Attest new evidence, new digest Adjust Policy dry-run first Report exceptions and cost Posture violations vs budget breach signal ranked work patched base image admissible again rule change monthly review The Operator Loop Security / platform Application we own Decision point Base-image owners are notified when a newer patched base exists; the fan-out is a single fact, not one ticket per image. v 1.0 · owner SRE · date 2026-09

How the loop closes

  • Measure violations, triage into blocked-at-admission and already-running, remediate by rebuilding on a patched base
  • Re-attestation produces a new digest — remediation is never a mutation of the old artifact
  • Policy changes go through dry-run before they change what the loop measures

Answering question 7

  • Base-image lineage is modelled as composition, not as a flat SBOM per image
  • One patched base becomes a single fact that fans out to every derived image, which is what makes this loop tractable
  • The cost is that layer identity must be stable and the composition must itself be attested — and that base-image ownership must be a real role, not a rota

Risk

  • The loop depends on an owner existing for every repository; unowned repositories accumulate violations that nobody triages
  • Cost attribution per team, phase 3, is what makes ownership stick
◀  Observability and Operations All views Security Trust Zones  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises27-operations-loop