Image integrity is the assurance that a container image has not been changed and still matches the trusted publisher’s version. In practice, it means the image digest, metadata, and often a digital signature can be checked before deployment. If any layer is modified, the image should no longer be trusted as the original build.
This matters because attackers often target registries and automation to replace a legitimate image with a tampered one under the same tag. If operators deploy by name alone, they may pull altered code without noticing. Defenses include verifying image digests, enforcing signature checks, and restricting who can push or retag images. In supply-chain incidents, image integrity is the control that helps detect whether a registry or token misuse has turned a trusted artifact into a delivery vehicle for malicious code.