Practical End-to-End Container Security at Scale
summary
Defines a concrete pipeline: enforce a base image whitelist and push patched base images with an automated biweekly rebuild so Dockerfiles pick new tags, lock registries behind auth, RBAC, SSL and Docker Content Trust after a $10,000 bounty proved risks. Integrate automated vulnerability scanning in CI (Anchore, Clair, commercial scanners) and fail builds on criticals, run docker-bench and kube-bench, log and alert on spawned shells or privilege escalation. At scale clean scanner DBs and prune test images with periodic scripts to avoid doubled scan volume.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:44Agenda
- 1:16Why?
- 1:41What does practical security mean?
- 2:29Why do traditional approaches not work?
- 3:20Container pipeline
- 4:20Securing container pipeline
- 4:43Base image security
- 7:35Container registry security
- 10:33Vulnerability scanning
- 13:21Docker Daemon security
- 14:05Docker runtime security
- 14:34Docker CIS benchmark
- 15:03Kubernetes CIS benchmark
- 15:43Realtime alerting in containers
- 15:58Issues at scale
- 17:22Helpful resources
related talks
34mDelivering Continuous Security with Docker
30mMaster the Container Security Model with
40mSecuring Containers on the High Seas
34mHow to Contain Security in your Containers
32mA Security State Of Mind: Compliance and ...
24mDon’t be a fail whale, secure your containers
05mContainer Security Best Practices
46mAdding security for reliable continuous delivery