Build and secure containers to support your CI/CD pipeline

Hello! I am João Rosa I am Software Consultant, focused on Quality. You can find me at @joaoasrosa 2

Horror story What we found at a customer 1.

The most important systems in your organisation are: the payroll system and the CI/CD server. 4

Problems found with CI/CD server Lifecycle management There is not a lifecycle management on the tool. It has Critical CVE’s. Misconfiguration The server holds multiple services. Also, the configuration of the services is not secure. Agents drift The build and deploy agents are in a drift state. Plus, old frameworks are installed. 5

LEAD TIME For new capabilities. Such as a new version of a framework, or new tool features. 6

A way out What we proposed to the customer 2.

SaaS Move from the on-premises solution, to a SaaS solution. It will mitigate some of the risks. Proposed solution Shift responsibilities From manage tooling, to enable development teams to deliver value. 8

Use containers to build and deploy ▪ Today, mature solutions offer containers as compute unit ▪ Isolated by default (between jobs) ▪ Granular capabilities ▪ Allow teams to create the container images 9

With great power, comes great responsibility! Ben Parker 10

How about security? Teams are creating their own containers! 11 Photo by Alistair MacRobert on Unsplash

Back to basics… on software development code test deploy 12

A (possible) solution Implementation details 3.

What test means for containers in a financial institution? We can understand it as testing the capabilities and security. Other definitions? 14 Photo by Saffu on Unsplash

What does that means? ▪ Test the dependencies ▪ Scan the dependencies 15

Test Test the container image, to assert the dependencies are installed according to the expectations. What does that mean? Scan Scan the container image, discovering if there are problems with any of the dependencies. Bonus, is it possible to monitor it? 16

Implementation ▪ The container image definition is a Dockerfile ▪ Testing using Google’s Container Structure Tests ▪ Scanning and monitoring using Snyk However there are other tools! :) 17

DEMO TIME 18

Container Structure Tests ▪ Command tests ▪ File Existence tests ▪ File Content tests ▪ Metadata tests ▪ License tests * 19 * (licenses allowed by Google)

Snyk ▪ Scan dependencies ▪ Monitoring snapshots of the dependencies 20

Thanks! Any questions? You can find me at ▪ @joaoasrosa ▪ jrosa@xebia.com 21

Credits Special thanks to all the people who made and released these awesome resources for free: ▪ Presentation template by SlidesCarnival ▪ Photographs by Unsplash 22