Best Practices for Securing Containerized Applications
summary
Shows a concrete pipeline: Docker Compose spins up Conjur (open source) + Postgres, Ansible runs a playbook that uses host factory token enrollment to give each container a machine identity, Summon injects secrets, and an app reads secrets via Conjur API. Demo rotates a password, restarts staging to pick up the new value, and revokes staging by editing declarative policy to cause immediate 403s. Claims scale to automatic enrollment of hundreds of nodes and uses 5‑minute short‑lived tokens.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:15Automation
- 0:44Confession Time
- 1:30Why Do We Care
- 2:31Perspective Matters
- 4:06Security Success Criteria
- 5:36Bad Practices
- 7:16Good Practices
- 9:11Nirvana State
- 11:31CI Secrets
- 12:58Machine Identity
- 14:25Offerings
- 17:24Policy
- 20:15Workflow
- 22:24Demo
- 26:09Loading Policies
- 27:24Sub Policies
- 30:16Set Secrets
- 32:24Playbook
- 34:09Test App
- 35:51Environment Variables
- 41:49Deploy Production
- 43:35Revocation
- 46:14Pros and Cons
- 48:06Aligning Velocity and Security
- 49:26Questions
related talks
35mSecuring Secrets at Scale: Integrating Ansible Automation with Conjur
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes
40mSecuring Containers on the High Seas
05mContainer Security Best Practices
34mHow to Contain Security in your Containers
46mSecuring Applications and Pipelines on a Container Platform
43mDocker Security: Start your Container Journey Safely
43mContainer Security: So Many Options, Use Them All!