The rapid rise of Linux containers as an enterprise-ready technology in 2015, thanks in no small part to the technology provided by the Docker project, should come as no surprise: Linux containers offer a broad array of benefits to the enterprise, from greater application portability and scalability to the ability to fully leverage the benefits of composite applications.
But these benefits aside, Linux containers can, if IT security procedures are not followed, also cause serious harm to mission-critical operations. As Red Hat's Lars Herrmann has pointed out, containers aren't exactly transparent when it comes to seeing and understanding all of their internal code. This means that tools and technologies to actually see inside a container are critical to enterprises that want to deploy Linux containers in mission-critical scenarios.
Deep Container Inspection
First, it's important to understand what this type of scanning actually entails – I published a post along those lines in September 2015, dubbing this sort of intense software scrutiny as Deep Container Inspection, or DCI. Similar to Deep Packet Inspection in the world of TCP/IP, DCI encompasses technologies to inspect policies in the user space and policies in Linux container metadata as well as those that can automate decisions based on these codified policies.
So how is Red Hat helping to enable DCI?
OpenSCAP
Red Hat has long been a contributor to the OpenSCAP project, which aims to deliver open source tools and policies for the Security Content Automation Protocol, a standard set down by the Federal government for automating IT security policies and procedures. Recent advancements in the project, backed by Red Hat expertise, now enable the OpenSCAP scanner to check Linux containers for vulnerabilities and exploits – while this capability is still in the upstream community, it's of critical need and one that Red Hat is very strongly pushing forward to become enterprise-ready.
CloudForms 4
Red Hat's recently launched cloud management software, CloudForms 4, also provides Linux container scanning capabilities in the form of its SmartState analysis. At a basic level, the SmartState analysis grabs a snapshot of the given packages within a container – paired with the scanning capabilities of both Black Duck Hub (see below) and OpenSCAP, CloudForms 4 provides the first line of information gathering required for effective and efficient container scanning.
Black Duck Collaboration
In October 2015, Red Hat announced a collaboration with Black Duck Software, a global leader in automating the security and management of open source software, to establish a trusted model for containerized application delivery. This has been a significant missing link in the “chain of trust” for Linux containers, as given where and how code originates and the nature of containers themselves, it can be very difficult to vet all functioning pieces of a containerized application. The first step in this work is the integration of Black Duck Hub, Black Duck's container scanning and vulnerability mapping software, with Red Hat's OpenShift Platform-as-a-Service (PaaS), while future plans are to integrate Black Duck scanning technologies as a complementary set of services within Red Hat's container certification workflow for Independent Software Vendors (ISVs).
Much like container technology itself, container scanning is fast-moving to keep up with the high interest in Linux containers from the enterprise datacenter. Much as we did with Linux, Red Hat aims to deliver safe, secure and certified Linux container images and infrastructure to our customers, and our work in the area of container scanning is the first step to achieve this goal.
So what are your thoughts on container scanning and DCI in particular? Let us know in the comments below.
Über den Autor
Nach Thema durchsuchen
Automatisierung
Das Neueste zum Thema IT-Automatisierung für Technologien, Teams und Umgebungen
Künstliche Intelligenz
Erfahren Sie das Neueste von den Plattformen, die es Kunden ermöglichen, KI-Workloads beliebig auszuführen
Open Hybrid Cloud
Erfahren Sie, wie wir eine flexiblere Zukunft mit Hybrid Clouds schaffen.
Sicherheit
Erfahren Sie, wie wir Risiken in verschiedenen Umgebungen und Technologien reduzieren
Edge Computing
Erfahren Sie das Neueste von den Plattformen, die die Operations am Edge vereinfachen
Infrastruktur
Erfahren Sie das Neueste von der weltweit führenden Linux-Plattform für Unternehmen
Anwendungen
Entdecken Sie unsere Lösungen für komplexe Herausforderungen bei Anwendungen
Original Shows
Interessantes von den Experten, die die Technologien in Unternehmen mitgestalten
Produkte
- Red Hat Enterprise Linux
- Red Hat OpenShift
- Red Hat Ansible Automation Platform
- Cloud-Services
- Alle Produkte anzeigen
Tools
- Training & Zertifizierung
- Eigenes Konto
- Kundensupport
- Für Entwickler
- Partner finden
- Red Hat Ecosystem Catalog
- Mehrwert von Red Hat berechnen
- Dokumentation
Testen, kaufen und verkaufen
Kommunizieren
Über Red Hat
Als weltweit größter Anbieter von Open-Source-Software-Lösungen für Unternehmen stellen wir Linux-, Cloud-, Container- und Kubernetes-Technologien bereit. Wir bieten robuste Lösungen, die es Unternehmen erleichtern, plattform- und umgebungsübergreifend zu arbeiten – vom Rechenzentrum bis zum Netzwerkrand.
Wählen Sie eine Sprache
Red Hat legal and privacy links
- Über Red Hat
- Jobs bei Red Hat
- Veranstaltungen
- Standorte
- Red Hat kontaktieren
- Red Hat Blog
- Diversität, Gleichberechtigung und Inklusion
- Cool Stuff Store
- Red Hat Summit