Dockerize Java Securely: SBOMs + Attestations + Cosign

Transcript

2. Whose Day is It?
3. Odin’s Day Thor’s Day Frigg’s Day
4. Whose Day is It? Odin’s Day Thor’s Day Freya’s Day
5. Whose Day is It on Tuesday?
6. Whose Day is It on Tuesday? Tyr
11. Dockerize Securely v2.0.0-halloween-edition Mohammad-Ali A’râbi BaselOne, Basel, BS, Switzerland
12. Mohammad-Ali A’râbi Software Engineer @ JobRad Docker Captain Author of “Docker and Kubernetes Security” Books: ContainerSecurity.dev LinkedIn, Twitter, Medium: @aerabi BlueSky, website: aerabi.com
13. Let’s fight CVEs together
14. CVE Common Vulnerabilities and Exposures They lurk in the shadows, awaiting an opportunity to attack! Which CVEs do you know?
15. CVE Common Vulnerabilities and Exposures They lurk in the shadows, awaiting an opportunity to attack! Meet: - React2Shell CVE-2025-55182 - Log4Shell CVE-2021-44228
16. Log4Shell Log4Shell was a zero-day vulnerability discovered in November 2021. In early 2022, everyone was talking about SBOMs .
17. SBOM Software Bill of Materials is a list of all of the packages on a Docker image. It became more popular after the Log4Shell incident. SBOMs help identify affected dependencies quickly.
18. $ docker scout sbom <image> Just to see: --format list To save it: docker scout sbom <image> --format spdx --output <file>
21. Jack Cryptojack Jack the Buur Jack-o’-Lantern 1 Docker Scout Jack-o’-Lantern is coming to illuminate the night
23. $ docker scout cves <image> Checks the Docker image for CVEs. Will use SBOM attestations if available.
24. $ trivy image <image> Scans OS and application dependencies for known CVEs. Use --severity HIGH,CRITICAL to prioritize.
25. 2 Hardened Images How hard can it be?
27. DHI Docker Hardened Images are minimal images designed to reduce attack surface and known vulnerabilities. Use -dev variants for build stages and minimal runtime variants in production.
28. # Regular Java runtime FROM eclipse-temurin:21-jre # Hardened Maven builder FROM dhi.io/maven:3-jdk21-dev AS build # Hardened Java runtime FROM dhi.io/eclipse-temurin:21-alpine3.23 Guess what’s the CVE difference?
29. # Regular Java runtime FROM eclipse-temurin:21-jre # Hardened Maven builder FROM dhi.io/maven:3-jdk21-dev AS build # Hardened Java runtime FROM dhi.io/eclipse-temurin:21-alpine3.23 1→ 0 0 Critical/high CVEs Java image CVEs Temurin: 2 critical , 8 high DHI Maven: 1 medium (not affected), 1 low DHI Temurin: 0 CVEs
31. 3 SBOM Attestations Passports for packages
33. $ docker buildx build --sbom=true -t <image> . Generates an SBOM attestation. Add --push to publish the image and its attestation to a registry.
34. FROM maven:3.9-eclipse-temurin-21 AS build WORKDIR /app COPY . . RUN mvn -B package -DskipTests # -------------------FROM eclipse-temurin:21-jre WORKDIR /app COPY --from=build /app/target/*.jar app.jar ENTRYPOINT ["java", "-jar", "app.jar"]
35. FROM maven:3.9-eclipse-temurin-21 AS build ARG BUILDKIT_SBOM_SCAN_STAGE=true WORKDIR /app COPY . . RUN mvn -B package -DskipTests # -------------------FROM eclipse-temurin:21-jre WORKDIR /app COPY --from=build /app/target/*.jar app.jar ENTRYPOINT ["java", "-jar", "app.jar"]
36. FROM maven:3.9-eclipse-temurin-21 AS build ARG BUILDKIT_SBOM_SCAN_STAGE=true WORKDIR /app COPY . . RUN mvn -B package -DskipTests # -------------------FROM eclipse-temurin:21-jre WORKDIR /app COPY --from=build /app/target/*.jar app.jar ENTRYPOINT ["java", "-jar", "app.jar"]
37. - name: Build and push uses: docker/build-push-action@v6 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} cache-from: type=gha cache-to: type=gha,mode=max
38. - name: Build and push uses: docker/build-push-action@v6 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} cache-from: type=gha cache-to: type=gha,mode=max provenance: mode=max sbom: true
39. Selfie Say CVE!
41. 4 The Signature Here is Evie
43. # Generate signing keys once cosign generate-key-pair # Sign a pushed image by digest cosign sign --key cosign.key $IMAGE
44. # Verify before deploying cosign verify --key cosign.pub $IMAGE Use an immutable image digest for $IMAGE (registry/repo@sha256:...).
45. Are we safe We have generated SBOM attestations, checked for CVEs, used DHI, and signed the images.
47. Shai Hulud Shai-Hulud spread through compromised npm packages. Malicious npm content has also crossed into Maven Central.
49. 0 SIP it before you ship it Let’s have a SIP of security
50. SIP: Security Immediate Plan containersecurity.dev/sip 1. Sandbox 2. Lock packages Sandbox your AI coding agent Pin packages; 5-day cooldown 3. Use DHI 4. SBOM Use hardened Docker base images Generate SBOM attestations 5. Check Scan your images for CVEs
51. $ sbx run claude Runs the coding agent in an isolated microVM. Proxy-managed credentials need not be exposed to the agent.
52. dependency locks Maven: pin versions in pom.xml Gradle: ./gradlew build --write-locks
53. SIP recap Sandbox → Lock → DHI → SBOM → Scan. Then sign and verify.
54. # Outro Get out! —Arnold Schwarzenegger
55. WASHESCHDUZMORGEGHA at: buy.ContainerSecurity.dev 50%
56. ContainerSecurity.dev Books Links Blog Games
57. Don’t forget to like and subscribe Disclaimer: BaselOne gave me this QR code. If you got phished, it’s not me hacking you.
58. Thanks! Do you have any questions? aerabi@gmx.de aerabi.com CREDITS: This presentation template was created by Slidesgo , and includes icons by Flaticon , and infographics & images by Freepik