3 ms·

Figure I would ask here: Have any DevOps or build folks had to deal with compliance audits regarding their docker containers? It's something certain developers

Figure I would ask here: Have any DevOps or build folks had to deal with compliance audits regarding their docker containers? It's something certain developers I've encountered seem to ignore, even when creating something that might handle health or financial information. Did you have to build your docker images from scratch, or did the security audit folks certify upstream images? What about updates?

orf 8y ago
Gitlab has a bunch of features around this: licensing, package scanning and docker CVE scanning.
- bloopernova 8y ago
  Cool, I had no idea. Thank you!
tonyhb 8y ago
Docker actually does this for you via Cloud when you store your images. It performs static analysis of all files/libs in your container to check for vulnerabilities, as opposed to the simpler `dpkg` list check which is not accurate.
- bloopernova 8y ago
  Cool, so at least some folks are thinking about this sort of thing. Thank you for the response!
choosegoose 8y ago
We use Twistlock (https://www.twistlock.com/ https://www.twistlock.com/) as it does the CVE scanning but you can setup rules for compliance, binary monitoring and a whole plethora of other security/auditing type things. It also has a jenkins plugin so you can fail builds if a certain threshold of CVEs/compliance failures are introduced by developers (the only way to actually get the team to care about security). Our security folks haven't really decided what to do with containers although some people are just using RHEL7 base images since its "enterprise-y". Our group personally uses alpine base images. If we have something like a java service hosted by Tomcat, we build alpine then build tomcat and then build our "service" container. While most people are fine pulling from Dockerhub, we do work in closed-loop environments and have a private docker registry where we host our "chain" of docker images which are versioned and updated regularly.
- bloopernova 8y ago
  Thank you, I will check that out.
FrenchTouch42 8y ago
Assuming you have a shell within your container, InSpec can be a great tool (https://www.inspec.io/ https://www.inspec.io/) as you can pass a "docker" target for your compliance profiles. Works great for us :)

orf 8y ago

Gitlab has a bunch of features around this: licensing, package scanning and docker CVE scanning.

bloopernova 8y ago
Cool, I had no idea. Thank you!

tonyhb 8y ago

Docker actually does this for you via Cloud when you store your images. It performs static analysis of all files/libs in your container to check for vulnerabilities, as opposed to the simpler `dpkg` list check which is not accurate.

bloopernova 8y ago
Cool, so at least some folks are thinking about this sort of thing. Thank you for the response!

choosegoose 8y ago

We use Twistlock (https://www.twistlock.com/ https://www.twistlock.com/) as it does the CVE scanning but you can setup rules for compliance, binary monitoring and a whole plethora of other security/auditing type things. It also has a jenkins plugin so you can fail builds if a certain threshold of CVEs/compliance failures are introduced by developers (the only way to actually get the team to care about security). Our security folks haven't really decided what to do with containers although some people are just using RHEL7 base images since its "enterprise-y". Our group personally uses alpine base images. If we have something like a java service hosted by Tomcat, we build alpine then build tomcat and then build our "service" container. While most people are fine pulling from Dockerhub, we do work in closed-loop environments and have a private docker registry where we host our "chain" of docker images which are versioned and updated regularly.

bloopernova 8y ago
Thank you, I will check that out.

FrenchTouch42 8y ago

Assuming you have a shell within your container, InSpec can be a great tool (https://www.inspec.io/ https://www.inspec.io/) as you can pass a "docker" target for your compliance profiles. Works great for us :)