So. Many. Vulnerabilities. Why are containers such a mess...
summary
Explains why most vulnerabilities come from base images and not app code, shows concrete examples: a one‑gig Ruby image with ~35 high severities, a scan finding 178 issues, and how multistage builds cut runtime bloat while keeping build tools. Recommends pinning full version tags, preferring slim or distroless images where feasible, rebuilding often, setting a scanned baseline, automating rebuilds/PRs when upstream fixes appear, and organizing teams as base‑image owners plus middleware and app layers so fixes propagate downstream.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:16Key Topics
- 1:58Three Key Principles
- 4:02Developer Day to Day
- 6:13Container Security
- 6:54Image Types
- 9:13Best Practices
- 10:33Docker File Examples
- 14:17Recommendations
- 20:58Macros
- 23:21Teams Responsibility
- 27:22Example
- 30:46Wrapup
- 33:18Live QA
related talks
25mMy Container Image has 500 Vulnerabilities, Now What?
35mSecuring Containers by Breaking In
40mSecuring Containers by Breaking in
52mThe Life of an Image: Evolution of Vulnerabilities in Popular Containers
47mSecuring Containers By Breaking In
34mWhat We Learned Dissecting the World's Most Popular Containers
30mMaster the Container Security Model with
29mDay in the Life of a Base Image: The Evolution of Vulnerabilities in the Most Popular C...