Continuous Delivery with Containers: The Good, the Bad, and the Ugly
summary
Continuous delivery must treat the container image as image-as-single-binary and run tests against that exact image through the pipeline; use Docker multi-stage builds or a test sidecar to avoid drift. Add labels and record metadata in a registry or Grafeas so automated gates (Notary/attestations) can enforce security. Run daily dependency and image scans (Clair, OWASP dependency-check) — Clair can report ~100 CVEs in a fresh OpenJDK image. Also validate container NFRs: CPU/memory accounting, entropy for crypto, and JVM limits.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:36Containers: Expectations versus reality
- 1:35Setting the scene...
- 4:42@danielbryantuk
- 6:46Velocity (with stability) is key to business success
- 9:00Container technology (and CD)
- 10:33Microservices multiply the challenges
- 11:27Make your dev environment like production
- 13:28Working remotely, locally..
- 15:40Lesson learned: Dockerfile content is super important
- 17:49Different test and prod containers?
- 19:32Docker multi-stage builds
- 20:21Building images with Jenkins
- 21:00Lesson learned: Metadata is valuable
- 22:15Metadata - Beware of "latest" Docker Tag
- 23:05Metadata - Adding Labels at build time
- 24:02Metadata - Adding Labels at runtime
- 24:27External registry with metadata support
- 27:51Running tests with containers
- 28:06Testing NFRs in the build pipeline
- 29:35Security Visibility: Basic (Java) Code Scanning
- 30:26Dependency Scanning
- 32:43Static Image Scanning
- 37:32Mechanical sympathy: Docker and Java
- 38:30Deployment
- 39:53Bedtime reading
related talks
47mContinuous Delivery with Containers: The Good, Bad, & Ugly
52mContinuous Delivery with Containers: The Good, the Bad, and the Ugly
34mDelivering Continuous Security with Docker
49mContinuous Delivery at Docker age
31mContinuous Security – integrating security into your pipelines
35mThe State of Your Supply Chain
47mContainer Security, Are You Doing It Wrong?
18mPractical End-to-End Container Security at Scale