"Willy Wonka and the Secure Container Factory"
summary
Compares base images and shows concrete tradeoffs: CentOS ~200MB, Ubuntu ~85MB, Alpine 3.8 (<5MB) and recommends fewer RUN/COPY layers plus multi-stage builds for compiled languages to shrink attack surface and speed deploys. Cites supply-chain danger with 17 malicious Docker Hub images, urges pinning images by version or digest (use docker inspect + jq to get the hash), checksum any downloaded tarball, run Aqua MicroScanner or CoreOS Claire in CI, enable 2FA on repos, add a non-root user and strip setuid binaries.
AI-written summary · about
chapters (11)
- 0:00Introduction and scope
- 2:33Optimizing image size
- 5:23Docker file best practices
- 10:25Securing the supply chain
- 14:02Managing dependencies
- 17:37Locking container versions
- 20:00Automated scanning
- 22:12Management strategy
- 24:25Least privilege principle
- 27:44Continuous deployment
- 32:54Q&A and concluding remarks
related talks
29m5 Security Best Practices For Production Ready Containers
29m5 Best Security Practices for your Production-Ready Containers
35mOptimizing Containers for Security and Scaling
35mSecuring Containers by Breaking In
14mSmall Containers? or Small Images?
35mDocker Security
20mCreating Production Ready Containers: What Devs Need to Know to Secure Their Containers
38mSo. Many. Vulnerabilities. Why are containers such a mess...