Delivering Continuous Security with Docker
summary
Describes concrete steps: a CI step runs dpkg --list and pip freeze into a database keyed by image tag so queries map running ECS containers to exact package versions; uses content-trust/notary and CoreOS Claire to pull and semi‑actively scan registry images; replaces a 72‑hour rebuild war room with targeted rebuilds of affected images; notes hundreds of containers and multi‑month image shelf life as the risk and shows automated rebuild + redeploy as the effective remedy.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:37Audience Poll!
- 1:04Implement an automated security measure for Docker?
- 1:23Found breaking API changes in patch releases?
- 5:16Why is security different with Docker?
- 8:36Immutable Infrastructure
- 9:42Once vulnerable ALWAYS vulnerable
- 11:15How did you respond to GLIBC
- 13:18Passive Data Collection
- 16:01Semi) Active Scanning
- 16:41Required by many compliance standards
- 20:50What is this "semi" active scanning
- 27:00Whats the way forward???
- 28:10Vendors promise to solve security and compliance
- 28:26They're solving one piece of the puzzle
related talks
18mPractical End-to-End Container Security at Scale
46mAdding security for reliable continuous delivery
46mA Security State of Mind: Continuous Security with Kubernetes
31mContinuous Security – integrating security into your pipelines
34mHow to Contain Security in your Containers
40mContinuous Delivery with Containers: The Good, the Bad, and the Ugly
44mDocker for DevSecOps
46mWhat Security People Want: Making DevSecOps Happen with Containers