Establishing Container Trust at Scale [I]
summary
Argues that container trust must be quantifiable at production scale and demonstrates a working integration that scans every image lifecycle event in OpenShift, annotates images, and surfaces which pods are affected. Uses OpenShift image streams, Jenkins build triggers, OpenSCAP plus static/fuzzing sources and Black Duck composition data. Tested at customer scale (40 nodes, ~100 image changes/day) against industry rates (~13,000 disclosures in 2016 ≈ 35/day) and targets answer impact within 1–2 hours across thousands of pods via annotated vulnerability metadata.
AI-written summary · about
chapters (14)
- 0:00Start
- 2:35Container Image Build Process
- 7:53Image Consistency and Pull Specifications
- 9:56Deployments and Triggers
- 11:06OpenShift Source To Image and Build Pipelines
- 12:23Patching Containers-A/B Testing Using Deployment config
- 13:14Security Driven Development and Deployment
- 16:22Question Everything and Continually Evaluate Trust
- 18:02Proprietary Software Rules Aren't Open Source
- 20:35The Tale of CVE-2017-5638 and Equifax
- 29:23Focus on Factors Impacting Risk
- 30:09We Don't Patch Containers - But Patches Matter
- 32:39Sources of Truth
- 33:04Layer Container Security For Maximum Impact
related talks
37mA question of trust: When good containers go bad
38mA Security State of Mind: Compliance and Vulnerability Audits for Containers
18mPractical End-to-End Container Security at Scale
32mA Security State Of Mind: Compliance and ...
55mCVE Overload: Scaling Container Vulnerability Scans
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
46mA Security State of Mind: Continuous Security with Kubernetes
35mThe State of Your Supply Chain