To verify an Apptainer container, run apptainer verify on the local SIF file. It checks that the image was signed with a PGP key or certificate and that the content is a bit for bit match of what the signer produced. It does not prove the contents are free of vulnerabilities.
What signing gives you
Apptainer's documentation says SIF images can be signed and later verified so a user can be confident that the image they obtained is a bit for bit reproduction of the container as the author intended. The signature is created over the metadata and content using a private key and added directly to the SIF file.
By default Apptainer uses PGP keys. It also supports X.509 key material and certificates. Public keys can be distributed manually or uploaded to, and retrieved from, a remote keyserver.
Steps
- Obtain the SIF file, for example by pulling it from a library or from an OCI registry with the oras scheme.
- Run verification against the local file.
apptainer verify my_container.sif
- Read the output. It lists the signing entity, the key fingerprint and the objects verified.
- Compare the fingerprint with one you got from the author through a separate channel, such as their project page.
- Only then run or deploy the image.
The docs note that the verify command only runs against a local SIF file. Containers signed with Singularity versions older than 3.6.0 need a legacy flag, which the documentation labels insecure, so avoid it unless you must.
Approval workflows
The documentation adds that a valid signature can show an image has been tested or reviewed and is approved for execution. Multiple signatures can be added to document progress through an approval process, and administrators can enable the Execution Control List feature to restrict which containers run, based on signatures.
| Check | Answers |
|---|---|
| Signature valid | Content unchanged since signing |
| Fingerprint matches author | Signer is who you expect |
| Scan of contents | Known vulnerabilities inside |
| Rebuild from definition | Image matches its recipe |
A signature covers integrity and origin. Pair it with a scan, as covered in Apptainer vs Docker on shared clusters.
Try it yourself
Click through it at your own pace, or open it full screen. Look at the packages found inside an image, which a signature check never lists.
Quick check
Does a valid signature mean the image is safe?
No. It shows the image was not modified after signing and who signed it. The contents can still include vulnerable packages.
Where do I get the signer's public key?
From the author or a keyserver, but confirm the fingerprint through a separate trusted channel before relying on it.
Safeguard's SBOM and dependency scanning includes container image scanning, and a free scan is available.
Sources
Last reviewed: 19 October 2026.
