You Might Still Need Patches for Denim
summary
Argues that patching shifts from in-place fixes to rebuilding images, using Kubernetes, container registries and content-addressable container registry digests so you can tell exactly what’s deployed. Demo shows fixing a Shellshock-vulnerable image and rolling it with a blue-green/live migration style deploy. Claims 95% of containers live less than a week so you can patch continuously (95% < 1 week) rather than emergency windows; cites Google’s Borg practice of patching ~4 billion containers/week with no downtime.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:40Overview
- 1:50Containers Kubernetes
- 8:24Traditional Software Supply Chain
- 12:27Supply Chain
- 15:17Containers
- 16:28Container Patch Management
- 18:31The Takeaway
- 19:46Poll
- 21:15Inspection
- 22:03Demo
- 25:41Bluegreen Deployment
- 27:00Live Migration
related talks
42mContainer Patching: Making It Less Gross Than the Seattle Gum Wall
32mP to V to C: The Value of Bringing “Everything” to Containers
10mProject Zero Day: Building the Ultimate Container Defense System
38mSo. Many. Vulnerabilities. Why are containers such a mess...
35mThe State of Your Supply Chain
32mA Security State Of Mind: Compliance and ...
45mSelf-Healing Pipelines? Resilient Deployments with Hardened Containers
22mUsing Buildpacks To Reduce Container Bloat and Attack Surface