Improve container security with automated base image updates
summary
Google runs automated base image updates for all App Engine and Cloud Functions customers and avoids rebuilding millions of deployed apps by rebasing — swapping base-image and runtime layers onto each app’s application layer just-in-time at startup. The implementation uses Cloud Native Buildpacks (pack, Google Cloud Buildpacks), tools like dive to inspect layers, and the pack rebase flow (pack rebase) so platform teams can roll base-image updates daily with no impact on startup time. This is production-proven on a 15‑year App Engine footprint.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker intro
- 1:47Google’s container security approach
- 6:09Building container images with build packs
- 12:42Why base image updates matter
- 16:59How Google rebases container images
- 21:19Demo of image rebasing with build packs
- 25:14Benefits of build packs for teams
- 27:02Q&A session
related talks
22mUsing Buildpacks To Reduce Container Bloat and Attack Surface
27mSecuring Your Apps and User Data with Google Cloud
31mBuildpacks: Pragmatic Solutions To Quick and Secure Image Builds
34mDelivering Continuous Security with Docker
11mAutomating Cloud Security Compliance: From Patching to Machine Image Building and Auto Scheduling
41mBuilding Apps in Kubernetes: The Unforgiving Sea of...
33mOCI in CF: For Buildpacks, Security and Interoperability
33mBuilding Images For The Secure Supply Chain