How to Contain Security in your Containers
summary
Concrete how to: step‑by‑step Dockerfile patterns for separating build vs runtime deps, commands for Docker trust sign and key management, Azure DevOps pipeline snippets that run tests with Talks/Pytest and run Trivy scans that fail on high/critical findings, CI credential roles and least‑privilege keys, registry access network controls, Kubernetes resource quotas and runtime monitoring with Microsoft Defender. Examples include tagging/publishing failed images and a worked pipeline that enforces scan thresholds so high/critical issues block release.
AI-written summary · about
chapters (6)
- 0:00Container security intro
- 2:00Secure container images
- 8:47Securing registries
- 13:42DevSecOps pipelines
- 25:00Production security best practices
- 30:59Key takeaways
related talks
05mContainer Security Best Practices
18mPractical End-to-End Container Security at Scale
26mThe 10 Container Security Tricks That (...)
33mHow do you secure your SDLC
30mMaster the Container Security Model with
24mDon’t be a fail whale, secure your containers
40mSecuring Containers on the High Seas
47mContainer Security, Are You Doing It Wrong?