2 ms·
I recently got called in to support one of my folks because some devops team was absolutely incensed they couldn't just pull in some rando docker container they
by kjs3 7y ago
I recently got called in to support one of my folks because some devops team was absolutely incensed they couldn't just pull in some rando docker container they'd found on the net. From a .cn domain. That failed the static analysis suite. For a production financial application. Fail fast indeed.
I get we need to adapt to support devops. I'm investing big resources to support that. It would be so much easier if so many devs didn't think devops == no oversight.
- icedchai 7y agoSo what actually prevented them from just doing this?
- kjs3 7y agoThe dev folks have an 'approved repository' workflow; when this team tried to deploy to QA the rouge container got flagged. Plus it failed the static analysis step in the pipeline. I assume a sufficiently clever dev could find a way around this, but it worked here. Maybe we just got lucky this time, but we did an asset audit when we found this one and didn't find anything that had slipped through. We're looking at deploying some tools (e.g. Dome9) that we think will close some of the loopholes and provide more automation. However, due to the complexity of these environments, I'm not sure there's a perfect solution.