I'm interested in information and experiences surrounding Docker security. I'd like to understand ways that a user/client could validate the contents of an image to ensure that the packaged applications/files are in compliance with their organization's/industry standard practices.
I've been reading online about security as far as establishing trust to validate the integrity and the publisher of data received from a registry(https://docs.docker.com/engine/security/trust/content_trust/), as well as Security Assurance of Docker Containers(https://www.sans.org/reading-room/whitepapers/cloud/security-assurance-docker-containers-37432)>, and I see some useful information around tools and practices to validate the security of containers and images.
Some tools I'm interested in exploring more are OpenSCAP docker tool(https://www.open-scap.org/resources/documentation/security-compliance-of-rhel7-docker-containers/) as well as Docker Bench for Security(https://github.com/docker/docker-bench-security) and Dockscan(https://github.com/kost/dockscan).
My question is, does anybody have any experience with dealing with security/compliance when deploying containers and sharing images or considering Docker as a solution for deploying applications internally/to external clients? If so, how would you recommend an organization best approach this topic?