Container Security: It’s All About the Supply Chain
summary
Argues that container security is a software supply chain problem and demands concrete controls: validate images at build, repository and runtime; enforce image signing and admission controllers; generate and check an SBoM; scan with SCA/SAST/DAST and container security tools; avoid “frying” images at boot—bake or buy, never fry. Recommends trusted, read‑only registries with automated promotion, least‑privilege runtimes, short image lifetimes, and policy‑driven CI/CD decisions that break builds when criteria fail.
AI-written summary · about
chapters (6)
- 0:00Start
- 3:50Supply Chain Threats
- 7:23Example: Trojan Source
- 19:35Use the Best Ingredients
- 26:22Container Security Validation
- 29:23What Are Container Orchestrators?
related talks
40mSecuring Containers on the High Seas
05mContainer Security Best Practices
46mWhat Security People Want: Making DevSecOps Happen with Containers
27mContainer Security Best Practices
47mContainer Security, Are You Doing It Wrong?
35mThe 10 steps of Container Security: It's not that hard !
35mThe State of Your Supply Chain
27mContainer Security at the Speed of CI/CD