3 ms·
A few more things to consider: * I've been playing with checkov recently as a way to track Dockerfile quality and best practices * If you use GitHub, here ar
by newman314 5y ago
A few more things to consider:
* I've been playing with checkov recently as a way to track Dockerfile quality and best practices
* If you use GitHub, here are some additional considerations
* Use image digests for base images and configure Dependabot to update
* Look into implementing OpenSSF Scorecard and Allstar
* Supply chain security is hot right now. Look into cosign (signing) and syft (SBOM)
* Step Security has a GitHub action to harden the runner. Think of it as Little Snitch for runners
- varunsharma07 5y agoThanks for the mention for harden-runner GitHub Action! sharing the link: https://github.com/step-security/harden-runner https://github.com/step-security/harden-runner
- dlor 5y agoThanks for the cosign mention! Maintainer here. The link is github.com/sigstore/cosign for anyone reading along!