Container security is the protection of the integrity of containers. This includes everything from the applications they hold to the infrastructure they rely on. Container security needs to be integrated and continuous. In general, continuous container security for the enterprise is about:
- Securing the container pipeline and the application
- Securing the container deployment environment(s) and infrastructure
Build security into the container pipeline
Follow these steps:
Containers are created out of layers of files. The container community often calls these files "container images." The base image is the most important for security purposes, because it is used as the starting point from which you create derivative images. Container security starts with finding trusted sources for base images. Even when using trusted images, though, adding applications and making configuration changes will introduce new variables. When bringing in external content to build your apps, you need to have proactive content management in mind.
- Integrating with enterprise security tools and meeting or enhancing existing security policies
Containers are popular because they make it easy to build, package, and promote an application or service, and all its dependencies, throughout its entire lifecycle and across different environments and deployment targets. But there are still some challenges to container security. Static security policies and checklists don’t scale for containers in the enterprise. The supply chain needs more security policy services. Teams need to balance the networking and governance needs of containers. Build and runtime tools and services need decoupling.
By building security into the container pipeline and defending your infrastructure, you can make sure your containers are reliable, scalable, and trusted. Get expert perspectives on security throughout the container application stack and life cycle with this webinar series.
Once you’ve obtained your images, the next step is to manage both access to, and promotion of, all container images your team uses. That means protecting the images you download as well as the ones you build. Using a private registry will allow you to control access through role-based assignments while also helping you manage content by assigning metadata to the container. Metadata will provide information like identifying and tracking known vulnerabilities. A private registry also gives you the power to automate and assign policies for the container images you have stored, minimizing human errors that may introduce vulnerabilities into your container.
The last step of the pipeline is deployment. Once you’ve completed your builds, you need to manage them according to industry standards. The trick here is to understand how to automate policies to flag builds with security issues, especially as new security vulnerabilities are found. Because patching containers is never as good of a solution as rebuilding them, integrating security testing should take into account policies that trigger automated rebuilds. Running on component analysis tools that can track and flag issues is the first part of this step. The second part is establishing tooling for automated, policy-based deployment.
Another layer of container security is the isolation provided by the host operating system (OS). You need a host OS that provides maximum container isolation. This is a big part of what it means to defend your container deployments environment. The host OS is enabled using a container runtime, ideally managed through an orchestration system. To make your container platform resilient, use network namespaces to sequester applications and environments, and attach storage via secure mounts. An API management solution should include authentication and authorization, LDAP integration, end-point access controls, and rate limiting.
Red Hat® OpenShift® includes Red Hat Enterprise Linux®. It automates the container application life cycle, integrates security into the container pipeline, and is designed with DevOps teams in mind. Our container catalog provides you with access to a large number of certified images, language runtimes, databases, and middleware that can run anywhere you run Red Hat Enterprise Linux. Images from Red Hat are always signed and verified to ensure origin and integrity.
We monitor our container images for newly discovered vulnerabilities (which includes a continually updated and publicly visible health index), as well as release security updates and container rebuilds that are pushed to our public registry. You can always review our annual Red Hat product security risk report, which details our response to known security vulnerabilities affecting enterprise software around the world each year.
Red Hat’s security partners can extend and enhance our container security capabilities with certified integrations. Red Hat OpenShift has security built into the platform, which complements our security partner solutions, to help secure applications and containers throughout the DevOps life cycle.
A large collection of supported programming languages, frameworks, & services