My Container Image has 500 Vulnerabilities, Now What?
Talkat KubeCon + CloudNativeCon North America 2021 · on Wednesday, 2021-10-13· at 16:30· Concourse Hall 151 + Online·
summary
A Snyk scan finds extreme cases like 800+ vulnerabilities in a Node image but shows concrete fixes: ~40% fixable by upgrading the base image and ~20% resolved by rebuilding. Recommendations are specific: trust upstream base images, use multi-stage builds and pinned runtime tags, build an internal base-image layer so fixes propagate, and filter by CVSS vector, exploit maturity and available patches (e.g. fix high-severity with exploits first). Also watch Kubernetes misconfigurations (hostPath, privileged, no resource limits) that amplify blast radius.
AI-written summary · about
chapters (14)
- 0:00Start
- 6:20Trust Factors
- 9:10GENERAL RECOMMENDATIONS
- 14:26Zero vulnerabilities in a container is almost impossible
- 18:59Using base images
- 19:18Distinct responsibilities
- 20:04Can you fix vulnerabilities once?
- 20:31Start with your own base image
- 21:01Establish a baseline What can downstream consumers lanore?
- 21:20Watch out for new vulnerabilities
- 21:41A middleware image
- 21:58The sum of all vulnerabilities
- 22:34Your application images
- 22:48Visualising ownership
related talks
38mSo. Many. Vulnerabilities. Why are containers such a mess...
35mSecuring Containers by Breaking In
21mWhat is the Best Container Security Workflow for Your Organization?
52mThe Life of an Image: Evolution of Vulnerabilities in Popular Containers
40mSecuring Containers by Breaking in
47mSecuring Containers By Breaking In
49mVulnerability Exploitation In Docker Container Environments
30mMaster the Container Security Model with