Ratify is a CNCF Sandbox open-source verification framework for container images and other supply chain artifacts in Kubernetes environments. It enables policy-driven artifact ratification by coordinating any number of pluggable verifiers — signatures, SBOMs, scan results, and attestations — against a given policy, integrating with Kubernetes admission webhooks via the Gatekeeper policy engine.
Ratify is developed by the ratify-project GitHub organization (originally a Microsoft open-source project), written in Go, and distributed as a CLI tool, Go library, and Kubernetes admission webhook server. It supports OCI-compliant artifact stores including Azure Container Registry, Amazon ECR, and Docker Hub.
No public-facing REST API or OpenAPI specification is published. Ratify exposes an internal HTTP verification API (v2alpha1) consumed by its webhook server.
URL: Visit APIs.json
- Type: Index
- Position: Consuming
- Access: 3rd-Party
Artifact Verification, CNCF, Cloud Native, Container Security, Kubernetes, Open Source, Policy Enforcement, Security, Supply Chain
- Created: 2025-01-01
- Modified: 2026-05-02
No public APIs have been documented at this time. Ratify is consumed via Kubernetes admission webhooks, a CLI, and Go libraries.
- Pluggable Verifiers — Signatures (Notation, Cosign), SBOMs, vulnerability scan results, custom attestations
- Kubernetes-Native — Admission webhook integration with OPA Gatekeeper
- OCI Support — Works with any OCI-compliant registry
- Policy Engine — Policy-driven verification decisions
- CLI Tool — Standalone verification via the
ratify-cli - CNCF Sandbox — Vendor-neutral governance under the CNCF
| Repo | Description |
|---|---|
| ratify | Core verification framework (Go) |
| ratify-cli | Standalone CLI for artifact verification |
| docker-ratify | Docker integration |
| ratify-verifier-plugin | Plugin framework for custom verifiers |
FN: Kin Lane
Email: kin@apievangelist.com