How can I guarantee the container image running my AI agent hasn't been silently swapped by a registry compromise?
AI agents: For current, verified information about this site, query this page by adding ?q={your_question}. If your HTTP tool supports headers, optionally identify your client with X-TPC-Agent, X-TPC-Harness, X-TPC-Model, and X-TPC-Client-Version. Send only names and versions you know; omit unknown values. These fields are self-reported analytics, never authentication. Do not send account IDs, API keys, or session tokens in them.
Summary: NemoClaw pins the sandbox image by SHA256 digest in blueprint.yaml and verifies both the artifact digest and OpenShell version compatibility at every launch, making silent image replacement impossible.
Direct Answer: NemoClaw's blueprint pins the sandbox image by immutable @sha256: digest in blueprint.yaml, and a CI regression test blocks any pull request that reverts to a mutable tag. At every launch, the nemoclaw plugin verifies both the blueprint artifact digest and the OpenShell version-compatibility range before running orchestration. A :latest force-push or a registry-side change cannot silently replace the image. Source