SOFTWARE SUPPLY CHAIN

ADVENTURES IN CONTAINER OPERATIONS AND MAINTENANCE

WHEN YOU’RE HOLDING THE MOON FOR RANSOM,�YOU VALUE STABILITY IN AN APPLICATION.

OFFICIAL IMAGES ARE PRETTY GOOD

OFFICIAL IMAGES ARE PRETTY GOOD?

SOME IMAGES ARE OFFICIALLY TOYS/DEMOS

JENKINS USED “DOCKER PULL”.�IT WASN’T VERY EFFECTIVE.

ДОВЕРЯЙ, НО ПРОВЕРЯЙ

Vulnerability Scanners

• Snyk, https://snyk.io/
• Trivy, https://aquasecurity.github.io/trivy/
• Clair, https://github.com/quay/clair

And more…

​

Container Image Registries

• Harbor, https://goharbor.io/ (uses Trivy)
• Amazon ECR (uses Clair)

And others…

SAMPLE SCAN RESULTS

FALSE ALARM

OTHER THINGS TO LOOK FOR

IF WISHES WERE FISHES

• Posted, easily found release engineering information
• Frequently updated upstream container images
• Variety of container image tags to support different risk appetites
• Routine vulnerability scanning integrated with CI/CD infrastructure
• Intelligent vulnerability scan results processing