Container security involves defining and adhering to build, deployment, and runtime practices that protect a Linux container—from the applications they support to the infrastructure they rely on.
As organizations transition to microservice design patterns and container technologies—such as Docker and Kubernetes—security teams are challenged to develop container security solutions that facilitate these infrastructure shifts. Container security needs to be integrated and continuous and support an enterprise’s overall security posture. In general, continuous container security for the enterprise is about:
- Securing the container pipeline and the application
- Securing the container deployment environment(s) and infrastructure
Containers are created out of layers of files. The container community often calls these files container images.
A tool like Buildah lets you build OCI- and Docker-compatible images from scratch, with or without an existing container image starting point.
Container images are the standard application delivery format in cloud-native environments, but even cloud-native companies mix workloads between cloud providers. The ideal container security solution should support all architectures.
The base image, or golden image, is the most important for security purposes, because it is used as the starting point from which you create derivative images. Container security starts with finding trusted sources for base images. Confirm that the image comes from a known company or open source group, is hosted on a reputable registry, and that the source code for all components in the image are available.
Even when using trusted images, though, adding applications and making configuration changes will introduce new variables. When bringing in external content to build your apps, keep proactive vulnerability management in mind:
- Integrate native security tools used across an enterprise to meet or enhance existing network security policies across your container ecosystem. Establish strong cloud security and application security standards.
- Identify modified container images that break policies or documented best practices—known as container misconfigurations—to reduce the likelihood and impact of potential compromises.
Containers are popular because they make it easy to build, package, and promote an application or service, and all its dependencies, throughout its entire lifecycle and across different workflows and deployment targets. But there are still some challenges to container security. Containers can help you implement finer-grained workload-level security, but they also introduce new infrastructure components and unfamiliar attack surfaces. The right container security solution must help secure the cluster infrastructure and orchestrator as well as the containerized applications they run.
Static security policies and checklists don’t scale for containers in the enterprise:
- The supply chain needs more security policy services.
- Security teams need to balance the networking and governance needs of a containerized environment.
- Tools used during the build, maintenance, and service stages need to have different permission policies.
An effective container security program seeks to remediate vulnerabilities in real-time and reduce the attack surface before images are deployed. By building security into the container pipeline and defending your infrastructure, you can make sure your containers are reliable, scalable, and trusted.
When gathering container images, ask:
- Are the container images signed and from trusted sources?
- Are the runtime and operating system layers up to date?
- How quickly and how often will the container be updated?
- Are security risks identified, and how will they be tracked?
Secure the container application stack and lifecycle
Get expert perspectives on security best practices throughout the container application stack and life cycle with this webinar series.
Once you’ve obtained your images, the next step is to manage both access to, and promotion of, all container images your team uses. That means protecting the images you download as well as the ones you build. Using a private registry will allow you to control access through role-based assignments while also helping you manage content by assigning relevant metadata to the container. This metadata will help you identify and track known vulnerabilities. A private container registry also gives you the power to automate and assign policies for the images you have stored, minimizing human errors that may introduce vulnerabilities into your container environment.
When deciding how to manage access, ask:
- What role-based access controls can you use to manage container images?
- Are there tagging abilities, to help sort images? Can you tag images as approved only for development, and then testing, and then production?
- Does the registry offer visible metadata that allows you to track known vulnerabilities?
- Can you use the registry to assign and automate policy (e.g. checking signatures, application code scans, etc.)?
The last step of the pipeline is deployment. Once you’ve completed your builds, you need to manage them according to industry standards. The trick here is to understand how to automate policies to flag builds with security issues, especially as new vulnerabilities are found. While vulnerability scanning remains important, it is only part of a larger set of security initiatives used to protect your container environments.
Because patching containers is never as good of a solution as rebuilding them, integrating security testing should take into account policies that trigger automated rebuilds. Running on component analysis tools that can track and flag issues is the first part of this step. The second part is establishing tooling for automated, policy-based deployment.
When integrating security testing and automated deployment, ask:
- How can you prevent patches to running containers, and instead use triggers to rebuild and replace containers with automated updates?
Another layer of container security is the isolation provided by the container’s node/host operating system (OS). You need a host OS that provides maximum container isolation. This is a big part of what it means to defend your container deployments environment. The host OS is enabled using a container runtime, ideally managed through an orchestration system. To make your container platform resilient, use network namespaces to sequester applications and environments, and attach storage via secure mounts. An API management solution should include authentication and authorization, LDAP integration, end-point access controls, and rate limiting.
When deciding how to defend your container infrastructure, ask:
- Which containers need to access one another? How will they discover each other?
- How will you control access and management of shared resources (e.g. network and storage)?
- How will you monitor container health?
- How will you automatically scale application capacity to meet demand?
- How will you manage host updates? Will all of your containers require updates at the same time?
Red Hat® OpenShift® includes Red Hat Enterprise Linux®. It automates the container application life cycle, integrates security into the container pipeline, and enables your transition from DevOps to a DevSecOps strategy. Our container catalog provides you with access to a large number of certified images, language runtimes, databases, and middleware that can run anywhere you run Red Hat Enterprise Linux. Images from Red Hat are always signed and verified to ensure origin and integrity.
We monitor our container images for newly discovered vulnerabilities (which includes a continually updated and publicly visible health index), as well as release security updates and container rebuilds that are pushed to our public registry. Red Hat Advanced Cluster Security for Kubernetes integrates with DevOps and security tools to help mitigate threats and enforce security policies that minimize operational risk to your applications.
Red Hat’s security partners can extend and enhance our container security capabilities with certified integrations. Red Hat OpenShift has security built into the platform, which complements our security partner solutions, to help secure applications and containers throughout the DevOps life cycle.
Plus, all of this other stuff is pretty good, too:
- Web-scale container orchestration and management
- Rich web console with multi-user collaboration features
- CLI & IDE interfaces
- Integration with CI
- Build automation & source-to-image
- Deployment automation
- Support for remote storage volumes
- Simplified installation & administration
- A large collection of supported programming languages, frameworks, & services