Opensource Container Security: A Brief Overview
summary
Overview of a small open source stack that actually enforces container security: Anchore scans images after build and blocks pushes to registries, Falco enforces deployment policies and can stop or delete nodes/images that violate rules, and Kubeless + Falco/sysdig act as a live watchdog capturing attacker activity and storing sysdig traces for forensics. Tools deploy via Helm or Docker and Jenkins has a plugin that configures scanning in ~5 minutes. Caveats: large or overlapping policies cause race conditions and too many actions can break forensic capture.
AI-written summary · about
related talks
38mOpen Source Security Tools for Kubernetes Applications
50mRuntime Security for Containers
18mPractical End-to-End Container Security at Scale
35mThe 10 steps of Container Security: It's not that hard !
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
33mKubernetes is Open by Default, Use Open Source to Secure
40mSecuring Containers on the High Seas
43m6 Strategies to Bring Order to Kubernetes Security Disruptions