How-to guides
Task-oriented guides — each solves one concrete problem against a running knock.
Rebuild & harden an image
Place an image through the rebuild path: inject internal CA certs, rewrite package sources to an internal mirror, stamp the result, and optionally sign it.
Verify a published stamp
Read the provenance stamp, fetch the package SBOM, and verify the signature on an image you did not build — with stock tools, no account and no cluster.
Attach a scan result
Ingest an upstream SARIF report as a signed OCI referrer with knock attach, using --fail-on as a severity CI gate.
Gate a promotion or CI step with knock verify
Turn knock's signed scan attestation, provenance stamp, and SBOM referrer into a single exit-0/1 gate with knock verify.
Inspect an image's SBOM
Find and fetch the SBOM referrer attached to a placed image, and enable CycloneDX alongside SPDX.
Audit coverage
Find images that lack the stamp with knock audit, and gate CI on coverage, signing, or SBOM presence.
Purge unused tags
The reference reaper: how marked tags get usage-gated and hard-deleted with knock purge, and how to wire your own usage oracle.
GC superseded scan referrers
Reap stale scan referrers with knock gc, keeping the newest per (tool, format).
Migrate off registry replication
Replace a legacy CI + registry-replication intake with knock destinations: same jobs, better provenance, and OCI referrers that survive to every team copy.
Run the reference deployment
Run knock as a Kubernetes CronJob — the kind demo and the production blueprint: git-synced policies, rootless buildkitd, a blast-radius consumer, and optional KEDA autoscaling.
Drop knock into an existing Jenkins/skopeo/Harbor intake
Replace a skopeo→Harbor tag-only mirror with knock: same per-image policy, digest-pinned provenance, a declared owner label, and a signed SBOM inventory — so incident-time blast radius is one query.
Operate the scan pipeline
Run, monitor, and triage the incremental Redis-Streams scan pipeline: first green scan, daily signals, and runbooks for a stuck queue, a growing dead-letter stream, and a coverage gap.