피드 구독

The rapid rise of Linux containers as an enterprise-ready technology in 2015, thanks in no small part to the technology provided by the Docker project, should come as no surprise: Linux containers offer a broad array of benefits to the enterprise, from greater application portability and scalability to the ability to fully leverage the benefits of composite applications.

But these benefits aside, Linux containers can, if IT security procedures are not followed, also cause serious harm to mission-critical operations. As Red Hat's Lars Herrmann has pointed out, containers aren't exactly transparent when it comes to seeing and understanding all of their internal code. This means that tools and technologies to actually see inside a container are critical to enterprises that want to deploy Linux containers in mission-critical scenarios.

Deep Container Inspection
First, it's important to understand what this type of scanning actually entails – I published a post along those lines in September 2015, dubbing this sort of intense software scrutiny as Deep Container Inspection, or DCI. Similar to Deep Packet Inspection in the world of TCP/IP, DCI encompasses technologies to inspect policies in the user space and policies in Linux container metadata as well as those that can automate decisions based on these codified policies.

So how is Red Hat helping to enable DCI?

OpenSCAP
Red Hat has long been a contributor to the OpenSCAP project, which aims to deliver open source tools and policies for the Security Content Automation Protocol, a standard set down by the Federal government for automating IT security policies and procedures. Recent advancements in the project, backed by Red Hat expertise, now enable the OpenSCAP scanner to check Linux containers for vulnerabilities and exploits – while this capability is still in the upstream community, it's of critical need and one that Red Hat is very strongly pushing forward to become enterprise-ready.

CloudForms 4
Red Hat's recently launched cloud management software, CloudForms 4, also provides Linux container scanning capabilities in the form of its SmartState analysis. At a basic level, the SmartState analysis grabs a snapshot of the given packages within a container – paired with the scanning capabilities of both Black Duck Hub (see below) and OpenSCAP, CloudForms 4 provides the first line of information gathering required for effective and efficient container scanning.

Black Duck Collaboration
In October 2015, Red Hat announced a collaboration with Black Duck Software, a global leader in automating the security and management of open source software, to establish a trusted model for containerized application delivery. This has been a significant missing link in the “chain of trust” for Linux containers, as given where and how code originates and the nature of containers themselves, it can be very difficult to vet all functioning pieces of a containerized application. The first step in this work is the integration of Black Duck Hub, Black Duck's container scanning and vulnerability mapping software, with Red Hat's OpenShift Platform-as-a-Service (PaaS), while future plans are to integrate Black Duck scanning technologies as a complementary set of services within Red Hat's container certification workflow for Independent Software Vendors (ISVs).

Much like container technology itself, container scanning is fast-moving to keep up with the high interest in Linux containers from the enterprise datacenter. Much as we did with Linux, Red Hat aims to deliver safe, secure and certified Linux container images and infrastructure to our customers, and our work in the area of container scanning is the first step to achieve this goal.

So what are your thoughts on container scanning and DCI in particular? Let us know in the comments below.


저자 소개

UI_Icon-Red_Hat-Close-A-Black-RGB

채널별 검색

automation icon

오토메이션

기술, 팀, 인프라를 위한 IT 자동화 최신 동향

AI icon

인공지능

고객이 어디서나 AI 워크로드를 실행할 수 있도록 지원하는 플랫폼 업데이트

open hybrid cloud icon

오픈 하이브리드 클라우드

하이브리드 클라우드로 더욱 유연한 미래를 구축하는 방법을 알아보세요

security icon

보안

환경과 기술 전반에 걸쳐 리스크를 감소하는 방법에 대한 최신 정보

edge icon

엣지 컴퓨팅

엣지에서의 운영을 단순화하는 플랫폼 업데이트

Infrastructure icon

인프라

세계적으로 인정받은 기업용 Linux 플랫폼에 대한 최신 정보

application development icon

애플리케이션

복잡한 애플리케이션에 대한 솔루션 더 보기

Original series icon

오리지널 쇼

엔터프라이즈 기술 분야의 제작자와 리더가 전하는 흥미로운 스토리