Iscriviti al nostro blog

The rapid rise of Linux containers as an enterprise-ready technology in 2015, thanks in no small part to the technology provided by the Docker project, should come as no surprise: Linux containers offer a broad array of benefits to the enterprise, from greater application portability and scalability to the ability to fully leverage the benefits of composite applications.

But these benefits aside, Linux containers can, if IT security procedures are not followed, also cause serious harm to mission-critical operations. As Red Hat's Lars Herrmann has pointed out, containers aren't exactly transparent when it comes to seeing and understanding all of their internal code. This means that tools and technologies to actually see inside a container are critical to enterprises that want to deploy Linux containers in mission-critical scenarios.

Deep Container Inspection
First, it's important to understand what this type of scanning actually entails – I published a post along those lines in September 2015, dubbing this sort of intense software scrutiny as Deep Container Inspection, or DCI. Similar to Deep Packet Inspection in the world of TCP/IP, DCI encompasses technologies to inspect policies in the user space and policies in Linux container metadata as well as those that can automate decisions based on these codified policies.

So how is Red Hat helping to enable DCI?

OpenSCAP
Red Hat has long been a contributor to the OpenSCAP project, which aims to deliver open source tools and policies for the Security Content Automation Protocol, a standard set down by the Federal government for automating IT security policies and procedures. Recent advancements in the project, backed by Red Hat expertise, now enable the OpenSCAP scanner to check Linux containers for vulnerabilities and exploits – while this capability is still in the upstream community, it's of critical need and one that Red Hat is very strongly pushing forward to become enterprise-ready.

CloudForms 4
Red Hat's recently launched cloud management software, CloudForms 4, also provides Linux container scanning capabilities in the form of its SmartState analysis. At a basic level, the SmartState analysis grabs a snapshot of the given packages within a container – paired with the scanning capabilities of both Black Duck Hub (see below) and OpenSCAP, CloudForms 4 provides the first line of information gathering required for effective and efficient container scanning.

Black Duck Collaboration
In October 2015, Red Hat announced a collaboration with Black Duck Software, a global leader in automating the security and management of open source software, to establish a trusted model for containerized application delivery. This has been a significant missing link in the “chain of trust” for Linux containers, as given where and how code originates and the nature of containers themselves, it can be very difficult to vet all functioning pieces of a containerized application. The first step in this work is the integration of Black Duck Hub, Black Duck's container scanning and vulnerability mapping software, with Red Hat's OpenShift Platform-as-a-Service (PaaS), while future plans are to integrate Black Duck scanning technologies as a complementary set of services within Red Hat's container certification workflow for Independent Software Vendors (ISVs).

Much like container technology itself, container scanning is fast-moving to keep up with the high interest in Linux containers from the enterprise datacenter. Much as we did with Linux, Red Hat aims to deliver safe, secure and certified Linux container images and infrastructure to our customers, and our work in the area of container scanning is the first step to achieve this goal.

So what are your thoughts on container scanning and DCI in particular? Let us know in the comments below.


Sull'autore

Ricerca per canale

automation icon

Automazione

Novità sull'automazione IT di tecnologie, team e ambienti

AI icon

Intelligenza artificiale

Aggiornamenti sulle piattaforme che consentono alle aziende di eseguire carichi di lavoro IA ovunque

open hybrid cloud icon

Hybrid cloud open source

Scopri come affrontare il futuro in modo più agile grazie al cloud ibrido

security icon

Sicurezza

Le ultime novità sulle nostre soluzioni per ridurre i rischi nelle tecnologie e negli ambienti

edge icon

Edge computing

Aggiornamenti sulle piattaforme che semplificano l'operatività edge

Infrastructure icon

Infrastruttura

Le ultime novità sulla piattaforma Linux aziendale leader a livello mondiale

application development icon

Applicazioni

Approfondimenti sulle nostre soluzioni alle sfide applicative più difficili

Original series icon

Serie originali

Raccontiamo le interessanti storie di leader e creatori di tecnologie pensate per le aziende