24 votes
Accepted

What are best and comprehensive practices to consider when running docker in production?

The host on which the containers are running Run the docker security bench on every node that runs docker containers https://github.com/docker/docker-bench-security Running the following command on ...
user avatar
  • 12.6k
8 votes

What are best and comprehensive practices to consider when running docker in production?

Docker images itself An additional option is to use Clair. Clair is an open source project for the static analysis of vulnerabilities in application containers (currently including appc and ...
user avatar
  • 12.6k
8 votes

What are best and comprehensive practices to consider when running docker in production?

In addition to the points in this thread; the following would be my recommendation: Get control over Docker PID1 with dumb-init ref: PID1 and Zombie reaping problem Do not run docker in production ...
user avatar
  • 441
7 votes

What are best and comprehensive practices to consider when running docker in production?

Docker is still in development. As with every other software in-dev bugs will happen, insecure features might be added, there could be architectural flaws that lead to security breaches. Do not ...
user avatar
  • 171
3 votes

How to raise awareness about the security risk involved with running Docker?

You might also want to run a scan for security vulnerabilities of some sample base images so your students get an idea of how changing the base can affect how secure your image is. For example ...
user avatar
3 votes

How to raise awareness about the security risk involved with running Docker?

A tool that I think is rather under recognised is s2i. The basic idea is that you don’t put a Dockerfile into your source repo specifying the runtime to use you keep your app code bare (just code). ...
user avatar
  • 1,162
3 votes
Accepted

How to securely pass sensitive data to EC2 Spot instances?

When you're running ephemeral workloads like you would on a spot instance the best bet, if you don't want to bake an ami, is going to be a secret store of some kind. The two most common methods I've ...
user avatar
  • 1,082
2 votes

Possibility of container breakout compared to VM (virtual machines)

Containers isolate an application on a shared OS, VM's isolate an OS on shared hardware. With those different levels of abstraction, you have different exploits and protections. A successful kernel ...
user avatar
  • 2,800
2 votes
Accepted

What percentage of microservice architectures employ polyglot programming models?

A good source for statistics could be stackshare.io. In general, polyglot services i.e. teams delivering different stacks could create silos, and additional overhead for diverse toolchains; ...
user avatar
2 votes
Accepted

What are trusted providers that offer wildcard certificates and associated costs to be used in an Orchestration Platform like Kubernetes?

Have a look at "Ingress" and "Cert-Manager": With a Kubernetes Ingress you can configure the load balancer, see e.g. https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer With "Cert-...
user avatar
  • 171
2 votes
Accepted

Mitigating Maven Central risks as seen from the DevSecOps perspective

What could be a feasible way to motivate Maven and repository makers to establish some kind of early time warning, like issue special headers on download, or and additionally for example reject ...
user avatar
  • 4,726
2 votes
Accepted

Devops Jenkins nexus integration?

No, you don't need maven. Maven is a build automation tool as ant and gradle are, generally, but not limited to, jvm based projects. Nexus is an artifact repository, but some others exists. Artifact ...
user avatar
  • 156
2 votes

What are best and comprehensive practices to consider when running docker in production?

If you are filling up your docker entrypoint with sed commands, consider this practice: Use a tool such as confd to manage your docker images configuration files and keep them updated Confd will ...
user avatar
1 vote

How to avoid disclosing account ID in AWS ARN

Your concern about obscuring your account ID is as valid as guarding your personal email address: if someone is trying to hack you, they could use your account id or email address to profile you or ...
user avatar
  • 158
1 vote

Collaboration tools recommendations like Slack

TBH, I would question the reason for it to be on-premise, since nowadays the trend is to look for SaaS solutions (so, nothing to maintain from an IT / Ops point of view). Slack has a free plan as long ...
user avatar
1 vote

Continuous deployment strategies vs DevSecOps

As you stated, requirements will differ based on company and industry policy; for us, the adjustment from "separation of duties" to automated deployments has been rough. As interim steps, we'...
user avatar
1 vote

Is there a limitation in AWS to open an IPSec VPN connection?

For me it looks to be tunnel misconfigured - "there is a message about protocol mismatch" Regarding the limitations quick google took me here: [strongSwan] strongswan limits
user avatar
  • 11
1 vote

How securely to keep google cloud service account key?

I would recommend you use their Google Cloud Secrets Engine. Documentation is here: https://www.vaultproject.io/docs/secrets/gcp/index.html Managing such sensitive secrets by any means other than a ...
user avatar
1 vote
Accepted

Mitigating Docker Compliance Issues - Can I put everything in the `daemon.json`?

Check out the dockerd options. This will apply to all containers managed by the Docker Daemon. Docker also has quite a bit of documentation on how to enforce different standards and compliance here.
user avatar
1 vote

How to raise awareness about the security risk involved with running Docker?

In my experience with "raising awareness about security" (for technical-minded people) is simply to show them the problem in action. Find out what concrete, practical problems actually exist, and ...
user avatar
  • 4,726
1 vote

CIS Benchmark for Docker and Docker Bench for Security: why, how and when?

Docker Bench is a scripted report of many of the CIS recommendations (at least those that can be scripted. Various organizations use the CIS recommendations as a starting point for their security ...
user avatar
  • 2,800
1 vote
Accepted

CIS Benchmark for Docker and Docker Bench for Security: why, how and when?

Larger organizations are concerned that containers introduce more security risks than traditional VMs as there isn't any hypervisor segregation. Developers running arbitrary images, that run as root, ...
user avatar
  • 1,162
1 vote

Why unable to find the exact path for grains storage in master?

These are built-in grains, which are collected at minion startup. Here's the code responsible for generating them. You cannot remove them, but you can overwrite them, for example to an empty value in ...
user avatar
  • 66
1 vote

Mitigating Maven Central risks as seen from the DevSecOps perspective

First of all there is one Maven central repository and that is Maven central. The website mvnrepository.com is just a search engine for Maven central. Secondly there is a gazillion of paid services ...
user avatar
  • 111
1 vote

Issue integrating acunetix with jenkins

We've configured the plugin properly (we're able to invoke acunetix from jenkins although we're having issues getting the report copied into the Jenkins workspace). The issue he might have run into is ...
user avatar
  • 11

Only top scored, non community-wiki answers of a minimum length are eligible