Simplify security compliance with bootable containers
summary
Claim is that building hardened OS images inside standard container workflows produces systems that are compliant from first boot. The demo uses podman, oscap-image-mode (OpenSCAP + SCAP Security Guide), podman-bootsy and bootable-image-builder to build a RHEL 10 bootable container hardened to a CIS profile; the resulting QEMU VM runs, verifies with OpenSCAP and passes the majority of CIS rules. Benefits: atomic updates and rollbacks from container registry; caveats: /etc and /var persistence, partitioning limits, and some remediations still failing.
AI-written summary · about
chapters (10)
- 0:00Security compliance intro
- 1:44Security compliance on Linux
- 2:47Bootable containers explained
- 7:25Compliance benefits
- 8:50Implementing compliance
- 11:16Demo: Hardening CIS profile
- 17:08Day-to-day with image mode
- 20:18Automated compliance workflow
- 22:49Resources & closing
- 23:35Q&A
related talks
32mA Security State Of Mind: Compliance and ...
35mHardening OS Distribution: Verifiable and sealed OS with bootc and composefs
44mThe Containerization of the Operating System: Exploring Bootc and the Future of Linux Deployment
43mContainer Security: So Many Options, Use Them All!
38mA Security State of Mind: Compliance and Vulnerability Audits for Containers
30mMaster the Container Security Model with
35mThe 10 steps of Container Security: It's not that hard !
32mSponsored Session: A New Security Standard for the AI Era: Zero-CVE and Real-Time Threat…