clair

Besides pointing pentester tools like metasploit at yourself, there are some nice scanners out there. Examples in no particular order: https://github.com/quay/clair https://github.com/anchore/grype/ https://github.com/eliasgranderubio/dagda/ https://github.com/aquasecurity/trivy So then you set up something like a cron job to scan everything for you and email the results once a week or whatever if you don't want to monitor things actively.

We used the "WITH RECURSIVE" basically the moment it shipped in Postgres for the original CoreOS Clair[0] data model which was a graph of software versions and vulnerabilities. It scaled well compared to a naive graph abstraction implemented outside the database, but when performance wasn't great, it REALLY wasn't great. After running that version in production for a couple years, we ended up throwing it out and remodeling the domain to be less graph-y to achieve more consistent performance. I've since worked on SpiceDB[1] which scales much better by taking the traditional design approach for graph databases and only treating Postgres as triple-store. IME, there's no short-cut: if you need a graph, you probably want to use a database optimized for graph access patterns. Most general-purpose graph databases are full of optimizations for co

There is also Clair. https://github.com/quay/clair

I didn't know ipfs cluster existed -- thanks for the reference. I was more thinking of a harbor[0] like cobbling of these technologies together -- harbor combines a bunch of F/OSS tools into one powerful registry solution. Here are a few: - Distribution for storing images - Notary for signing - Clair for static analysis Based on this I was thinking of was basically Distribution + ipfs cluster + a small management daemon. The daemon is only there to tie the other pieces together and present a unified interface but the bulk of the work can be done with the other pieces. [0]: https://github.com/goharbor/harbor/wiki/Architecture-Overvie... [1]: https://github.com/docker/distribution [2]: https://github.com/theupdateframework/notary [3]: https://github.com/coreos/clair

These tools exist: https://github.com/coreos/clair https://help.github.com/articles/about-security-alerts-for-v...

There is an entire genre of such tools now. Some names to look up are BlackDuck Hub[0] (commercial) and CoreOS Clair[1] (opensource). At Pivotal we use both -- BlackDuck is built into a number of our pipelines and Clair is shipped as part of PKS (in the Harbor registry[2] contributed by VMWare). A lot of our customers also use other security scanning tools that have expanded to include container scanning. [0] https://www.blackducksoftware.com/products/hub [1] https://github.com/coreos/clair [2] https://github.com/vmware/harbor

After using https://github.com/coreos/clair to scan some official images, I was blown away by the amount of exploits in every one. Seems like the only path forward if security is a priority is to build the base layers from scratch...

Just like Clair (https://github.com/coreos/clair), only, for GitHub

CoreOS's clair[1] will automatically reject (or alert) on new deployments of containers with known CVEs. So at a minimum, it could have let the administrators know they were running vulnerable images and fix the issue before the hack occurred. [1] https://github.com/coreos/clair

when both the delivery (pipelines) and the units going in them (container images with deployment descriptors) are automated, its really easy and straight-forward to plug-in a variety of automated checks (e.g. https://github.com/coreos/clair, organizational policies, governance, etc)

This is something near and dear to my heart! The great thing about container images is the software distribution is based on static assets. This enables scanners to give teams actionable data without being on every host. This is a net new capability and I think enables better security in organizations who adopt containers. And unlike "VM sprawl" container systems are generally introspectable via a cluster level API like Kubernetes and scanning doesn't require active agents on every node. Two things that have happened recently in this space: - Quay.io[1] offers scanning as a standard feature on all accounts including free open source accounts. This also includes notifications to external services like Slack. This is what it looks like when you ignore an image[1]. - The Kubernetes community has started automating scans of all of the contain

I hope the processes keep improving. They recently introduced Alpine SecDB[0], which is their database (YAML files) of CVEs. I've been told from one of their developers that it may not be actively maintained. I hope they stick with it since now we can use that in Clair[1] to improve the transparency of containers. [0]: http://git.alpinelinux.org/cgit/alpine-secdb/ [1]: https://github.com/coreos/clair

Why were people horrified? I liked the points you made in your slides, specifically patching openssl in containers is a great use case. When will this connector be beta? By the way this connector along with something like "clair" would be a good foundation for vulnerability management system for containers in production: https://github.com/coreos/clair