Not-So-Fantastic Leaks, and Where to Find Them In Containers
summary
Builds reveal hidden baggage: a 230 MB app sitting inside a 3.2 GB image and leftover layers that keep secrets and dev artifacts. A Tekton pipeline builds with Kaniko, generates an SBOM with SIFT, scans with GRYPE, and uses Skopeo/Cosign to publish; pipeline fails when GRYPE finds high-severity issues in nltk and an exposed API key, then succeeds after patching and removing the secret, publishing image plus SBOM to the registry.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:07rm doesn't remove!
- 1:27docker context
- 1:40installing packages • Simple installations could install vast trees of dependencies
- 1:57How do we surface hidden problems?
- 2:50Grype: A lightweight vulnerability scanner
- 3:23Tying together these tools into a workflow...
related talks
30mWhoops! I Accidentally Leaked My Credentials (again)
26mDigging Into Your App's Container Image Layers for Sneaky Vulnerabilities
28mFresh Secrets From the Docks: Lessons Learnt From Analyzing 180,000 Public DockerHub Images
28mBuilding Images for the Secure Supply Chain
34mUnpacking Open Source Security in Public Repos & Registries
33mWhoops! I Accidentally Leaked My Cloud Keys
35mEnhancing Software Composition Analysis Resilience Against Container Image Obfuscation
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...