Beyond Container Image Signing: How We Enforce Software Supply Chain Policies at Datadog
Datadog, Tuesday, October 20th, 2026
Datadog describes Turnstile, its internal system that enforces software supply chain policies at deployment time.
Datadog says image signing cannot detect a malicious source change, poisoned dependency or compromised build runner that occurs before signing.
Its internal system, Turnstile, generates cryptographically signed, tamper-evident attestations across an artifact's lifecycle.
Turnstile evaluates those attestations against environment-specific policies at deployment time.
The post explains how Datadog combined open source frameworks and standards, including SLSA principles, to build verifiable, auditable deployment decisions with little developer friction.