Cloud, Containers & Security
summary
Argues container signing is now practical with cosign with GitHub OIDC, recommends removing long‑lived tokens, and flags SBOMs as often incomplete; claims a supply‑chain breach forces real change — cites the $2 billion Jaguar Land Rover impact. Shows concrete tooling: Sigstore, Chainguard images, NPM trusted publisher, Terratest and GitOps/Crossplane for drift, warns about GenAI creating nondeterministic infra, and says QEMU is slow so prefer cross‑compiling Go/Rust binaries.
AI-written summary · about
chapters (6)
- 0:00Intro
- 3:11Cloud lessons learned
- 9:06Containers: Mature or still evolving?
- 17:17Security in a cloud native world
- 27:10Infrastructure as code today & audience Q&A
- 44:20Outro
related talks
37mSecuring OSS across the whole supply chain and beyond
48mContainer Security: It’s All About the Supply Chain
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
36mPanel Discussion: Modern App Security Requires Containers
28mBuilding Images for the Secure Supply Chain
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
40mSecuring Containers on the High Seas