Containers, metadata and you

ContainerSched 2017 keynote about the benefits of metadata for managing container images

Transcript

1. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved. Containers, metadata and you Liz Rice @lizrice | @aquasecteam
2. 2 @lizrice Containers
3. 3 @lizrice Container Images
4. 4 @lizrice
5. Metadata you can build in
6. 6 @lizrice Container images Dockerfile FROM MAINTAINER COPY CMD LABEL Image File system layer Metadata Metadata File system layer Metadata
7. 7 @lizrice
8. 8 @lizrice The only true identifier for an image is its SHA
9. 9 @lizrice The only true identifier for an image is its SHA sha256:da4fd23ca6bf973782f20c1c946fdb74d 0a17f874c634bfa82b0999975fb347c
10. After the build
11. 11 @lizrice Image stored in a registry with a tag [my.registry.io/]my-org-name/my-repo:tag lizrice/hello:3
12. 12 @lizrice Labels can refer to external files Dockerfile FROM ... LABEL Image File system layer Metadata URL
13. Is this sufficient?
14. 14 @lizrice ▪ Testing ▪ Vulnerability scanning ▪ Security profiling ▪ Approvals & signoffs ▪ … ▪ Deploy ▪ … ▪ Support ▪ Prune What happens to your images after they’re built? - test results - vulnerability reports - seccomp / AppArmor profile - signoff records - check / use these? - support team contacts - deployment records
15. Post-build metadata
16. 16 @lizrice
17. 17 @lizrice registry myorg/myrepo Store metadata for an image sha256:0a3... sha256:178... latest 1.4 images data blobs 1.3 metadata
18. 18 @lizrice Store metadata for an image registry myorg/myrepo sha256:0a3... sha256:178... latest 1.4 images data blobs 1.3 _manifesto metadata
19. Manifesto demo
20. 52.174.107.27
21. Admission control pattern
23. 23 @lizrice Admission control Start deploy Is image OK? Run image Fail Check the metadata for the image ▪ Test results? ▪ Approvals? ▪ Image / vulnerability policies?
24. Admission control demo
25. Trusted metadata
26. 26 @lizrice
27. 27 @lizrice
28. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved. github.com/aquasecurity/manifesto