Securing Dockerized apps in the Microsoft ecosystem
summary
Demonstrates concrete use of Docker Scout to find image-level SCA issues, enforce policies locally and in CI, and produce SBOMs and attestations; upgrades a base image (Alpine 3.14→3.19) and bumps an NPM dependency (express 19.2) on a developer laptop, which removes all critical/high findings while leaving one medium and one unspecified; shows Docker Desktop layer tracing, GitHub Actions/Azure DevOps integration, and policy blocking before deploy.
AI-written summary · about
chapters (11)
- 0:00Docker security challenges
- 1:57Regulatory changes
- 3:45CICD compliance friction
- 4:26Docker Scout overview
- 7:16Security in developer workflows
- 10:30Updating base images
- 12:57Debugging licenses locally
- 14:45Fixing critical vulnerabilities
- 16:53Local vs production fixes
- 18:40Automating security checks
- 19:43Q&A
related talks
20mSecuring the software supply chain with Docker Scout and Amazon ECR
37mDockerize Securely: SBOMs + Attestations + Bake
18mPractical End-to-End Container Security at Scale
36mContainer Security Made Easy – Tools and Techniques for Developers
34mHow to Contain Security in your Containers
46mAdding security for reliable continuous delivery
38mFrom Docker'fail to Dockerfile.. a true story!
34mDelivering Continuous Security with Docker