Mission Possible: The 45-Minute Path to Bullet-Proof Java Container Images
summary
Shows a concrete recipe: replace a 1 GB Eclipse Temurin/JDK image that scans at 46 CVEs with a multi-stage Dockerfile using a minimal JRE base and hardened Liberica runtime to drop image size to ~200 MB and reduce CVEs to zero, enforce non-root runtime, verify base by digest pinning and SBOMs and Cosign signatures, triage remaining findings with CVSS, and automate updates with Dependabot/Renovate; demos use OSV scanning and gives copy‑paste Dockerfile plus verification checklist.
AI-written summary · about
chapters (11)
- 0:00Welcome and mission setup
- 3:25Why container security matters
- 9:27Limit container privileges
- 11:36Shrink container size
- 13:24Prioritize vulnerabilities
- 18:26Hardened container images
- 21:17Choose hardened image vendor
- 27:03Build with hardened image
- 30:35Establish image provenance
- 36:12Mission accomplished summary
- 41:07Q&A and closing
related talks
52mSecuring Your Java Containers by Breaking In
46mStranger Danger: Securing Your Java Containers by Breaking In
31mFast and Distroless Java in Containers: the Recipe!
34mDefence Against the Docker Arts
40m"Willy Wonka and the Secure Container Factory"
40mSecuring Containers by Breaking in
39mA Journey to Distroless
35mSecuring Containers by Breaking In