DOCKER CONTAINER SECURITY

Docker’s enormous user base — recently surpassing 10 million users and 242 billion image pulls — shows that containerization is changing how applications are built. The responsibility for security is increasingly shifting to developers. So, it’s important to scan Docker images before pushing them to Docker Hub or another registry in order to find and fix vulnerabilities in Linux packages, user permissions, network configurations, open-source tools, or access management. Such a scan can help you uncover and remediate vulnerability issues in your application and infrastructure before you ship.

KUBERNETES CONTAINER SECURITY

Kubernetes offers a host of security controls to help make your clusters, workloads, and containers safer. It’s important to note that Kubernetes requires self-configuration since none of the security controls are configured when you deploy Kubernetes. Furthermore, while Kubernetes offers controls and features to help create a secure cluster, the default security configurations often aren’t enough. Deploying workloads securely requires expertise in Kubernetes. Check out our page on Kubernetes security best practices to learn more.

GKE CONTAINER SECURITY

Google Kubernetes Engine (GKE) provides many tools to secure workloads. It’s good to take a layered approach to GKE security by configuring security features for access controls, workloads, and other security aspects. GKE can be run in standard mode, where you manage the underlying infrastructure, and autopilot, where GKE provisions and manages the infrastructure. Snyk Container’s Kubernetes integration allows customers to secure workloads on GKE, in either standard or autopilot, uncover vulnerabilities in both container images and application code, and scan your Kubernetes configurations for issues.

AKS CONTAINER SECURITY

Microsoft Azure Kubernetes Service (AKS), like GKE, comes with robust security features, such as integration with Azure Policy and consistently fast updates and patches. However, it requires a semi-manual process to upgrade cluster components to newer versions and requires network policies to be enabled when creating the cluster. As with GKE, Snyk can scan your Kubernetes configurations and containers, and enable automatic monitoring as you deploy AKS resources.

EKS CONTAINER SECURITY

Amazon Elastic Kubernetes Service (Amazon EKS) has a strong set of security features by default and operates on the AWS shared responsibility model — which defines who is responsible for the different elements of container security. Usually, AWS is responsible for the security “of” the cloud whereas you, the customer, are responsible for security “in” the cloud.  As with other Kubernetes options mentioned above, Snyk integrates with EKS and ECR (AWS Elastic Container Registry) easily, to scan your Kubernetes configurations and containers, and enable automated monitoring as you deploy to EKS.

SECURE YOUR CODE AND ITS DEPENDENCIES

Containerization is a way to deliver cloud-native applications faster, which is likely one of the reasons you’re creating containers in the first place. Containers have expanded the meaning of application code, but code remains the area that’s most directly controlled by developers. Open source dependencies can easily dwarf the amount of proprietary code, so it’s important to integrate scanning tools like SCA and SAST tools to automate the process of analyzing code and dependencies. It’s also possible to scan containers but catch issues directly in git commits and repositories, which likely better fits the development process.

START WITH A MINIMAL BASE IMAGE FROM A TRUSTED SOURCE

While size matters for portability and fast downloads, it also reduces the number of moving parts that can potentially harbor vulnerabilities. Ideally, each container image would have your code and the minimum amount of additional packages to enable an application to run. In practical terms, however, you’re going to have a large number of applications and need to find common ground to make container images manageable.

MANAGE ALL THE LAYERS IN BETWEEN THE BASE IMAGE AND YOUR CODE

Base images require special considerations since you inherit whatever comes in the base image as you build up your own image on top of it. Even if you start with a slim image, chances are you’ll need to add tools and libraries, in addition to your code and the necessary installations to make things work. All of these need to be monitored for vulnerabilities.

USE ACCESS MANAGEMENT

In the context of containers, access means the ability for a given user to execute a specific operation over a given container resource. Typical activities fall under the general umbrella of Create, Read, Update, or Delete (CRUD). The specifics of access management depend on the container platform. For example, in Kubernetes users live outside the cluster, which means administrators need to manage identities outside the cluster using TLS certificates, OAuth2, or other methods of authentication.

SECURING CONTAINER INFRASTRUCTURE

Since container registries are designed to foster collaboration by creating a secure place to store and share containers, they have the potential to introduce vulnerabilities, malware, and exposed secrets. They often come with built-in security features, and a security protocol such as TLS should always be used when connecting with a registry.  Likewise, Kubernetes includes tools for creating and enforcing security controls at both the cluster and network level. Check out our article on container registry security for more information.

Using Snyk Container to secure containers

With millions of container vulnerabilities in the wild, finding, prioritizing, and remediating vulnerabilities can be overwhelming to developers. Snyk Container cuts through the noise of typical vulnerability reports by detecting and fixing application and container vulnerabilities together, even if you don’t have access to the original source code running in your containers.