Container Patching: Making It Less Gross Than the Seattle Gum Wall
summary
Presents a pragmatic system: about a few thousand GKE/Anthos containers are managed by standardizing on distroless base images in a small set of registries (GCR/Artifact Registry), enforcing pre-submit checks and admission controllers (Gatekeeper + Cosign attestations), scanning with multiple engines, using go voltcheck for reachability, automatically rebasing base images and creating aggregated bugs tied to a checked-in ownership file, tracking inventory and relationships in Spanner, and measuring SLO-driven escalation and dashboards to prove fixes actually roll out.
AI-written summary · about
chapters (17)
- 0:00Start
- 0:47A Trip Down Empathy Lane
- 6:05Good Start: Runtime Detection
- 6:56Prevent: Strategy
- 9:43Alternatives: Admission
- 12:12Prevent: Summary
- 13:00Detect: Problems
- 16:34False Positives vs. Coverage
- 18:22Detect: Noise
- 21:08Detect: Summary
- 21:53Problems: Multi-layer Complex Process
- 23:37Our Solution: Simplified Process
- 25:18Monitor: Problems
- 27:14Monitor: Composition
- 27:46Monitor: Visibility
- 29:26Monitor: Alternatives
- 31:37Links
related talks
30mYou Might Still Need Patches for Denim
30mA secure journey on Kubernetes
18mPatching Your Way to Compliance with a Small Team and a Pile of Technical Debt
28mKubernetes Security Low-Hanging Fruit
37mSupply Chain Security in Kubernetes
25mCloud Native Deployments in Air Gapped Environments
22mAirgapped Kubernetes - Hannes Probst
37mAchieving High Security at Scale with Microservices