Safer Apps from Docker Security Building Blocks
summary
Seven open source components form a secure container stack: Infrakit offers declarative machine lifecycle with rolling updates and reverse uptime to eliminate drift and evict persistent intruders; LinuxKit builds tiny immutable OS images with a hardened kernel, LinuxKit immutable rootfs and WireGuard support; containerd and runC provide content-addressable runtime guarantees and content-addressable image pulls; Notary (TUF) enables threshold signing and key rotation for trusted delivery; SwarmKit gives mutual TLS, per-node certificates, automated root key rotation and in-memory secrets delivery.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:48Platform Agnostic
- 4:26Reverse Uptime
- 6:42Roling Deploys
- 26:21Implements The Update Framework
- 31:08Secure Node Introduction
- 35:31Distribution
- 37:23Root Rotation
- 43:02Configuration
- 43:53Verified Boot
related talks
31mSecure Substrate for Container Apps
37mIt’s 2018; Are My Containers Secure Yet?!
43mContainer Security: So Many Options, Use Them All!
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
36mPanel Discussion: Modern App Security Requires Containers
45mMaking Containers Safer
46mA Security State of Mind: Continuous Security with Kubernetes
18mPractical End-to-End Container Security at Scale