Shocking Shells and Bleeding Hearts: Do you know what’s inside your container?

“What’s inside the containers I consume?”

The crux of this question is due to the fact that containers operate under the traditional security model present in Linux. Containers improve the isolation of applications, but they don’t fully contain.

This means that improperly implemented or even malicious containers can cause real damage, just like an improper or malicious application. As a result, containers must also operate within the security and certification ecosystem that covers applications today.

For adoption of containers to accelerate, establishing trust or provenance, is critical. Just like traditional applications, enterprises must be able to clearly identify where a container originated and what components are packaged in the container. They must trust the provider of the container to assert that the container contents will not introduce malicious or vulnerable code into production environments. And this assertion cannot cover just a point in time. Containers will have a lifecycle that must be managed. Affected containers must be identified quickly and patched or replaced to maintain security. This is where one of the greatest benefits of containers, ease of deployments across a variety of platforms, also creates one of the greatest challenges. Customers must have the management tools available that allow them to track containers across all platforms and quickly respond to patching or replacement.

Red Hat is at the front of the container revolution, driving forward the technology and services needed to accelerate adoption. It takes a significant commitment to bring these new features to a state of commercial readiness, and we’ve made significant contributions to the Docker project, the Linux kernel, and other technologies supporting containers to help drive enterprise-class features. Necessary technologies, like cgroups and namespaces, have long been incorporated into Red Hat Enterprise Linux. SELinux is a crucial part of our container strategy, delivering the security framework to help isolate containers and support higher levels of security. And we’re leading the way in the approach for managing and updating the container and the host platform, including developing tools to deliver “atomic” updates to the host and providing containerized applications that can be replaced with a minimum of effort, even at scale.

But provenance cannot be established by technology alone. Our history of enterprise support and our extensive, specialized partner network have been brought to bear on containers so that we can provide a “chain of trust” from container creation through delivery to retirement. We want IT organizations to be able to verify that a container originated at a trusted, verified source, to track that container as it is deployed across all manner of platforms, and to be confident that the container will receive the support and updates required throughout its lifecycle. For broad container adoption in the enterprise, this is critical.

There are many questions to be answered before containers can be considered enterprise-ready. Enterprises need a trusted, proven guide through this rapidly evolving world, and Red Hat is committed to advance both the technology and the ecosystem that supports it to make it enterprise-consumable, as we did with Linux.

Image credit: