Optimizing Containers for Security and Scaling
summary
Shows how building minimal images from scratch and a simple hardening script cuts image size and attack surface — nginx drops from 142 MB (Alpine) to 8 MB nginx image and overall pipelines often get 10–20x speedups (sometimes 100x), ASP.NET sees ~2x. Builds remove shells so containers run with no shell for debugging, limiting in-container debugging. Uses Trivy for vulnerability scanning (notes many false positives) and promotes signed artifacts with cosign and SLSA to produce SBOMs and enforce supply-chain security.
AI-written summary · about
chapters (13)
- 0:00Introduction and background
- 2:23Kubernetes in critical infrastructure
- 5:51Defense in depth strategy
- 8:43Developer responsibility for security
- 12:16Software bill of materials importance
- 15:09Hardening containers with positive lists
- 19:50Impact of container size reduction
- 21:57Supply chain security with signing
- 25:29Conclusion and final thoughts
- 27:02Q&A session part 1
- 28:08Q&A session part 2
- 30:58Q&A session part 3
- 32:02Q&A session part 4
related talks
14mSmall Containers? or Small Images?
40m"Willy Wonka and the Secure Container Factory"
01h 01m.NET and Containers - each layer of abstraction indistinguishable from magic
40mBuilding Smaller Container Images
38mSo. Many. Vulnerabilities. Why are containers such a mess...
33mBuilding Images For The Secure Supply Chain
16mSimplifying the Journey of Your Containerized Application from Dev to Production
28mBuilding Images for the Secure Supply Chain