Show: 14
Show Overview: Brian and Tyler talk address some of the many layers of security required in a container environment. This show will be part of a series on container and Kubernetes security. They look at security requirement in the Container Host, Container Content, Container Registry, and Software Build Processes.
Show Notes and News:
- 10 Layers of Container Security
- Google, VMware and Pivotal announced a Hybrid Cloud partnership with Kubernetes
- Google and Cisco announced a Hybrid Cloud partnership with Kubernetes (and more)
- Docker adds support for Kubernetes to DockerEE
- Rancher makes Kubernetes the primary orchestrator
- Microsoft announces new Azure Container Service, AKS
- Oracle announced Kubernetes on Oracle Linux (and some installers)
- Heptio announces new tools
Topic 1 - Let’s start at the bottom of the stack with the security needed on a container host.
- Linux namespaces - isolation
- Linux capabilities and SECCOMP - restrict routes, ports, limiting process calls
- SELinux (or AppArmor) - mandatory access controls
- cGroups - resource management
Topic 2 - Next in the stack, or outside the stack, is the sources of container content.
- Trusted sources (known registries vs. public registries (e.g. DockerHub)
- Scanning the content of containers
- Managing the versions, patches of container content
Topic 3 - Once we have the content (applications), we need a secure place to store and access it - container registries.
- Making a registry highly-available
- Who manages and audits the registry?
- How to scan container within a container?
- How to cryptographically sign images?
- Identifying known registries
- Process for managing the content in a registry (tagging, versioning/naming, etc)
- Automated policies (patch management, getting new content, etc.)
Topic 4 - Once we have secure content (building blocks) and a secure place to store the container images, we need to think about a secure supply chain of the software - the build process.
- Does a platform require containers, or can it accept code? Can it manage secure builds?
- How to build automated triggers for builds? How to audit those triggers (webhooks, etc.)?
- How to validate / scan / test code at different stages of a pipeline? (static analysis, dynamic analysis, etc.)
- How to promote images to a platform? (automated, manual promotion, etc.)
Feedback?
- Email: PodCTL at gmail dot com
- Twitter: @PodCTL
- Web: http://podctl.com
Popular Podcasts
Las Culturistas with Matt Rogers and Bowen Yang
Ding dong! Join your culture consultants, Matt Rogers and Bowen Yang, on an unforgettable journey into the beating heart of CULTURE. Alongside sizzling special guests, they GET INTO the hottest pop-culture moments of the day and the formative cultural experiences that turned them into Culturistas. Produced by the Big Money Players Network and iHeartRadio.
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by Audiochuck Media Company.
The Brothers Ortiz
The Brothers Ortiz is the story of two brothers–both successful, but in very different ways. Gabe Ortiz becomes a third-highest ranking officer in all of Texas while his younger brother Larry climbs the ranks in Puro Tango Blast, a notorious Texas Prison gang. Gabe doesn’t know all the details of his brother’s nefarious dealings, and he’s made a point not to ask, to protect their relationship. But when Larry is murdered during a home invasion in a rented beach house, Gabe has no choice but to look into what happened that night. To solve Larry’s murder, Gabe, and the whole Ortiz family, must ask each other tough questions.