Questions tagged [devsecops]

Use this tag for questions about DevOps and Security

Filter by
Sorted by
Tagged with
3
votes
1answer
44 views

How to securely pass sensitive data to EC2 Spot instances?

Right now, we only use EC2 on-demand instances, and we provision sensitive data (credentials, private keys, etc.) on the instances' EBS which are encrypted with a KMS key. My understanding is that I ...
3
votes
3answers
63 views

How to raise awareness about the security risk involved with running Docker?

I'm in the process of preparing a Docker course for students with little to no familiarities with containers, the underlying OS mechanisms involved, and their implied limitations. In many Docker ...
0
votes
2answers
62 views

CIS Benchmark for Docker and Docker Bench for Security: why, how and when?

I just learned about Docker Bench for Security and CIS Benchmark for Docker Community Edition. Why, how and when am I supposed to use these tools?
3
votes
1answer
43 views

Why unable to find the exact path for grains storage in master?

I am trying to completely remove the grains from the system. I have one master and one minion setup(minion id= minion1). I am doing salt minion1 grains.ls that is listing me all the grains Now I ...
1
vote
1answer
68 views

Possibility of container breakout compared to VM (virtual machines)

What is exactly the (higher) vulnerability at least theoretically of a container compared to VM? given, all security recommendations are implemented (like, user context is root, no host sensitive ...
0
votes
1answer
30 views

What percentage of microservice architectures employ polyglot programming models?

One of the tenets of microservices is the polyglot, autonomous services (developed in different programming languages). In my experience (online reading and YouTube and discussions with developers) it ...
0
votes
0answers
63 views

Integration Kubernetes with rancher?

In real production integration between Rancher and Kubernetes, please give an example topology and a scenario. Do we still need Rancher when I can manage the cluster with Kubernetes service that ...
1
vote
2answers
75 views

What are trusted providers that offer wildcard certificates and associated costs to be used in an Orchestration Platform like Kubernetes?

Currently, certbot and nginx are used to create a trusted webpage. Recently, an attempt was made to move the images to a kubernetes cluster on google cloud platform. A guide was found to configure an ...
3
votes
2answers
77 views

Mitigating Maven Central risks as seen from the DevSecOps perspective

AFAIK there are two official primary repositories for Maven packages (Java language): search.maven.org offered by Sonatype Inc. mvnrepository.com offered by a private person @frodriguez Now ...
2
votes
1answer
232 views

Issue integrating acunetix with jenkins

The first of all, thank you for reading my question, I really appreciate it! I am trying to integrate jenkins and acunetix (a vulnerability scanner software), but it seems to be near impossible...My ...
0
votes
1answer
2k views

Devops Jenkins nexus integration?

I want to try to upload any set of artifacts from any type of project ( Java, node, PHP, .net, go ). I know that once a developer pushes a code to git, Jenkins should take it and run the test case on ...
40
votes
6answers
3k views

What are best and comprehensive practices to consider when running docker in production?

Finally, you are so much in love with Docker that you want to move your online business-critical production systems with sensitive customer data to a Docker Swarm. Some might even already have done so....