Container Security

  1. Securing the Build Phase
    1. Container Supply Chain Overview
      1. Supply Chain Components
        1. Supply Chain Attack Vectors
          1. Trust Boundaries in the Supply Chain
            1. Supply Chain Risk Assessment
            2. Base Image Security
              1. Selecting Trusted Base Images
                1. Official Image Verification
                  1. Image Source Validation
                    1. Publisher Reputation Assessment
                      1. Image Provenance Tracking
                      2. Minimalist Base Images
                        1. Distroless Images
                          1. Google Distroless Images
                            1. Building Custom Distroless Images
                              1. Benefits and Limitations
                              2. Alpine Linux
                                1. Alpine Security Features
                                  1. Package Management in Alpine
                                    1. Size and Performance Benefits
                                    2. Scratch Images
                                      1. Use Cases for Scratch Images
                                        1. Static Binary Deployment
                                      2. Base Image Hardening
                                        1. Removing Unnecessary Packages
                                          1. Disabling Unused Services
                                            1. Updating System Packages
                                              1. Configuring Secure Defaults
                                              2. Base Image Vulnerability Management
                                                1. Automated Vulnerability Scanning
                                                  1. Vulnerability Assessment Tools
                                                    1. Scan Result Interpretation
                                                      1. Remediation Strategies
                                                    2. Dockerfile Security Best Practices
                                                      1. User and Permission Management
                                                        1. Creating Non-root Users
                                                          1. Setting User Context in Dockerfile
                                                            1. Managing User IDs and Group IDs
                                                              1. File Ownership and Permissions
                                                              2. Secret Management in Builds
                                                                1. Avoiding Hardcoded Secrets
                                                                  1. Environment Variable Security
                                                                    1. Build Argument Limitations
                                                                      1. Secret Injection Techniques
                                                                      2. Multi-stage Build Security
                                                                        1. Reducing Final Image Size
                                                                          1. Removing Build Dependencies
                                                                            1. Separating Build and Runtime Environments
                                                                              1. Artifact Management
                                                                              2. Dockerfile Instruction Security
                                                                                1. COPY vs ADD Security Implications
                                                                                  1. RUN Instruction Best Practices
                                                                                    1. EXPOSE Port Management
                                                                                      1. WORKDIR Security Considerations
                                                                                      2. Health Check Implementation
                                                                                        1. Defining Effective Health Checks
                                                                                          1. Health Check Security Implications
                                                                                            1. Monitoring Container Health
                                                                                            2. Attack Surface Reduction
                                                                                              1. Minimizing Image Layers
                                                                                                1. Removing Development Tools
                                                                                                  1. Disabling Unnecessary Network Services
                                                                                                    1. File System Optimization
                                                                                                  2. Static Analysis and Vulnerability Assessment
                                                                                                    1. Image Vulnerability Scanning
                                                                                                      1. CVE Database Integration
                                                                                                        1. Automated Scanning Workflows
                                                                                                          1. Continuous Vulnerability Monitoring
                                                                                                            1. False Positive Management
                                                                                                            2. Operating System Package Scanning
                                                                                                              1. Package Manager Integration
                                                                                                                1. Vulnerability Severity Assessment
                                                                                                                  1. Package Update Strategies
                                                                                                                    1. Dependency Conflict Resolution
                                                                                                                    2. Application Dependency Scanning
                                                                                                                      1. Language-specific Scanners
                                                                                                                        1. Third-party Library Assessment
                                                                                                                          1. License Compliance Checking
                                                                                                                            1. Dependency Update Management
                                                                                                                            2. Static Application Security Testing (SAST)
                                                                                                                              1. Code Vulnerability Detection
                                                                                                                                1. Security Rule Configuration
                                                                                                                                  1. CI/CD Pipeline Integration
                                                                                                                                    1. Result Triage and Remediation
                                                                                                                                    2. Infrastructure as Code Scanning
                                                                                                                                      1. Dockerfile Security Analysis
                                                                                                                                        1. Kubernetes Manifest Scanning
                                                                                                                                          1. Configuration Drift Detection
                                                                                                                                            1. Policy Compliance Checking
                                                                                                                                          2. Software Bill of Materials (SBOM)
                                                                                                                                            1. SBOM Generation
                                                                                                                                              1. SBOM Creation Tools
                                                                                                                                                1. SBOM Format Standards
                                                                                                                                                  1. SPDX Format
                                                                                                                                                    1. CycloneDX Format
                                                                                                                                                      1. SWID Tags
                                                                                                                                                      2. Automated SBOM Generation
                                                                                                                                                      3. SBOM Management
                                                                                                                                                        1. SBOM Storage and Distribution
                                                                                                                                                          1. Version Control Integration
                                                                                                                                                            1. SBOM Validation
                                                                                                                                                              1. SBOM Signing and Verification
                                                                                                                                                              2. Vulnerability Management with SBOMs
                                                                                                                                                                1. Dependency Tracking
                                                                                                                                                                  1. Vulnerability Impact Assessment
                                                                                                                                                                    1. Patch Management Planning
                                                                                                                                                                      1. Incident Response Support
                                                                                                                                                                    2. Build-time Secret Management
                                                                                                                                                                      1. Secret Classification
                                                                                                                                                                        1. Build-time vs Runtime Secrets
                                                                                                                                                                          1. Secret Sensitivity Levels
                                                                                                                                                                            1. Secret Lifecycle Management
                                                                                                                                                                            2. Secure Secret Injection
                                                                                                                                                                              1. Docker BuildKit Secrets
                                                                                                                                                                                1. Multi-stage Build Secrets
                                                                                                                                                                                  1. External Secret Management Integration
                                                                                                                                                                                    1. Secret Rotation Strategies
                                                                                                                                                                                    2. Secret Detection and Prevention
                                                                                                                                                                                      1. Secret Scanning Tools
                                                                                                                                                                                        1. Pre-commit Hooks
                                                                                                                                                                                          1. CI/CD Secret Detection
                                                                                                                                                                                            1. Secret Remediation Procedures

                                                                                                                                                                                        Previous

                                                                                                                                                                                        1. Introduction to Container Security

                                                                                                                                                                                        Go to top

                                                                                                                                                                                        Next

                                                                                                                                                                                        3. Securing the Ship Phase