3 ms·

Shrink to Secure: Kubernetes and Secure Compact Containers

14 points by Terretta 3y ago

cipherself 3y ago
Re: scanning of images, if you're using Google Container Registry (or Google Artifact Registry) there's also Artifact Analysis and Vulnerability scanning which you can turn on (and pay for)[0] Re: security, defining security contexts for containers and pods are quite important, the container should not run as root, you should drop all capabilities, ...etc. For example securityContext: runAsNonRoot: true runAsGroup: 1000 runAsUser: 1000 privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL You should also use something like kubescape[1] to regularly scan your cluster (or helm files or yaml files). Furthermore, you should use an admission controller[2] like Gatekeeper[3] to enforce certain policies in your clusters e.g. containers should always have a securityContext. [0] https://cloud.google.com/artifact-registry/docs/analysis https://cloud.google.com/artifact-registry/docs/analysis [1] https://github.com/kubescape/kubescape https://github.com/kubescape/kubescape [2] https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/ https://kubernetes.io/docs/reference/access-authn-authz/admi... [3] https://github.com/open-policy-agent/gatekeeper https://github.com/open-policy-agent/gatekeeper
kylequest 3y ago
Wonder if anybody is really using buildpacks... The stats i've seen recently show that it doesn't have much adoption and I'm very curious why it's not adopted more. The post also doesn't mention SlimToolkit (aka DockerSlim), which is now a CNCF Sandbox project. It represents another major way to create minimal container images.
- gsantoro 3y ago
  buikdpacks is actually used by Google cloud to build container images from your app source code. i used dockerslim in the past and i was impressed. i didn't add to the article since i wasn't aware it became a CNCF protect. I wasn't sure who was using it.

14 points by Terretta 3y ago

Re: scanning of images, if you're using Google Container Registry (or Google Artifact Registry) there's also Artifact Analysis and Vulnerability scanning which you can turn on (and pay for)[0] Re: security, defining security contexts for containers and pods are quite important, the container should not run as root, you should drop all capabilities, ...etc. For example securityContext: runAsNonRoot: true runAsGroup: 1000 runAsUser: 1000 privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL You should also use something like kubescape[1] to regularly scan your cluster (or helm files or yaml files). Furthermore, you should use an admission controller[2] like Gatekeeper[3] to enforce certain policies in your clusters e.g. containers should always have a securityContext. [0] https://cloud.google.com/artifact-registry/docs/analysis https://cloud.google.com/artifact-registry/docs/analysis [1] https://github.com/kubescape/kubescape https://github.com/kubescape/kubescape [2] https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/ https://kubernetes.io/docs/reference/access-authn-authz/admi... [3] https://github.com/open-policy-agent/gatekeeper https://github.com/open-policy-agent/gatekeeper

kylequest 3y ago

Wonder if anybody is really using buildpacks... The stats i've seen recently show that it doesn't have much adoption and I'm very curious why it's not adopted more. The post also doesn't mention SlimToolkit (aka DockerSlim), which is now a CNCF Sandbox project. It represents another major way to create minimal container images.

gsantoro 3y ago
buikdpacks is actually used by Google cloud to build container images from your app source code. i used dockerslim in the past and i was impressed. i didn't add to the article since i wasn't aware it became a CNCF protect. I wasn't sure who was using it.