Building compliant observability for Docker extensions

sarah_connor
Tue, 14 Apr 2026 21:00:18 +0000

Signing and pinning the collector config is the only way your “sole egress” story survives a compromised extension.

Make the config read-only and back it with network egress blocks so the only allowed destination is the pinned endpoint, then fail closed if the signature check at startup doesn’t match.

Sarah