containerd/imgcrypt

imgcrypt is an OCI image encryption package that extends containerd to support encrypted container images.

The tool addresses the need to encrypt container image layers at rest and in transit. It provides a library that integrates with containerd's image handling and implements the ctd-decoder command for decrypting images during runtime. The approach relies on the ocicrypt library for cryptographic operations on individual image layers. Users can encrypt images with RSA key pairs and push them to registries, then pull and run them through containerd with automatic decryption.

Adoption requires containerd 1.3 or later, with containerd 1.4 or later needed for Kubernetes integration. The tool is most relevant for environments where image confidentiality is a compliance or security requirement. The project provides both a library API for integration and command-line tools: ctd-decoder for containerd's internal use and ctr-enc as an extended version of containerd's ctr tool for manual encryption and decryption operations. Configuration for Kubernetes is documented separately in containerd's CRI decryption guide.

The project maintains active engagement with its maintainers through documented governance and contribution processes shared with the broader containerd project. Development follows containerd's established standards and guidelines for sub-projects, with clear ownership and contribution pathways defined in the project repository.