CIIV: A Hybrid Framework for Real Time Container Image Integrity Verification

Container technology has become ubiquitous among users and enterprises for its lightweight footprint and ease of deployment. Con tainer images automatically install all required packages and dependen cies, and are freely shared and maintained in public registries. However, the open nature of these registries has also led to rising incidents of im ages seeded with malicious code. We present CIIV, a framework that defends user systems in real time against such tampered images. CIIV inspects images layer by layer, produces cryptographic measurements, and verifies them on a blockchain. An optimized local verifier—tightly controlled by a Loadable Kernel Module and user-space agent—allows CIIV to run transparently without altering the Docker binary. With an average initialization overhead of less than one second—negligible in practice—CIIV blocks malicious containers while preserving system performance.