SlideShare a Scribd company logo
@behemphi
@stackengin
e
D O C K E R D O C K E R
D O C K E R … S E C U R I T Y … D O C K
E R
B O Y D H E M P H I L L , D I R E C T O R O F E V A N G E L I S M
Docker Docker - Docker Security - Docker
@behemphi
@stackengin
G O A L S
• Understand Why Docker is
Such a Big Deal
Love to @petecheslock
@behemphi
@stackengin
G O A L S
• Understand Why Docker is
Such a Big Deal
• Consider Docker Security
Concerns
Love to @petecheslock
@behemphi
@stackengin
G O A L S
• Understand Why Docker is
Such a Big Deal
• Consider Docker Security
Concerns
• Ponder a Rational Docker
Adoption Strategy Love to @petecheslock
@behemphi
@stackengin
– B O Y D H E M P H I L L
“As and Ops director, I am personally guilty of
pooping rainbows on security concerns.”
Docker Docker - Docker Security - Docker
@behemphi
@stackengin
W H O A M I ?
• Technologist
@behemphi
@stackengin
W H O A M I ?
• Technologist
• Community Builder
@behemphi
@stackengin
W H O A M I ?
• Technologist
• Community Builder
• Extroverted Nerd
@behemphi
@stackengin
W H O A M I ?
• Technologist
• Community Builder
• Extroverted Nerd
• Evangelist
@behemphi
@stackengin
- T H E A U S T I N D E V O P S C O M M U N I T Y
“Come to Docker Austin and Austin DevOps. Your
participation will move the conversations towards
your passion - security.”
Docker Docker - Docker Security - Docker
@behemphi
@stackengin
T H I S T H I N G O F
W H I C H Y O U
S P E A K ?
• Docker Docker Docker
@behemphi
@stackengin
T H I S T H I N G O F
W H I C H Y O U
S P E A K ?
• Docker Docker Docker
• Orchestration, Service
Discovery, Community
@behemphi
@stackengin
T H I S T H I N G O F
W H I C H Y O U
S P E A K ?
• Docker Docker Docker
• Orchestration, Service
Discovery, Community
• Like what you hear? Come
join the conversation:
http://goo.gl/YyyJOx
@behemphi
@stackengin
- B O B Q U I L L I N - C E O
“Buy copious amounts of StackEngine goodness.”
Docker Docker - Docker Security - Docker
@behemphi
@stackengin
W H O A R E
Y O U ?
• Have heard of Docker
@behemphi
@stackengin
W H O A R E
Y O U ?
• Have heard of Docker?
• Have experimented with
Docker on the job?
@behemphi
@stackengin
W H O A R E
Y O U ?
• Have heard of Docker?
• Have experimented with
Docker on the job?
• Are using Docker in a
production environment?
@behemphi
@stackengin
- S E C U R I T Y H O B B I T S
“Unicorns nothing, Balrogs is more like it!”
Docker Docker - Docker Security - Docker
@behemphi
@stackengin
C O M M O N
G R O U N D
• Philosophy
@behemphi
@stackengin
C O M M O N
G R O U N D
• Philosophy
• Model
@behemphi
@stackengin
C O M M O N
G R O U N D
• Philosophy
• Model
• Implementation
@behemphi
@stackengin
C O M M O N
G R O U N D
• Philosophy
• Model
• Implementation
• Tooling
@behemphi
@stackengin
“Don’t be a tools”
H T T P S : / / G O O . G L / R T 2 S W F
@behemphi
@stackengin
M I C R O -
S E R V I C E S
M I C R O - T E A M S
• Docker makes micro-
service philosophy
available to mere mortals
@behemphi
@stackengin
M I C R O -
S E R V I C E S
M I C R O - T E A M S
• Docker makes micro-
service philosophy
available to mere mortals
• Containers are
infrastructure boundaries
for services
@behemphi
@stackengin
M I C R O -
S E R V I C E S
M I C R O - T E A M S
• Docker makes micro-
service philosophy
available to mere mortals
• Containers are
infrastructure boundaries
for services
• Extraordinary business for
early adopters.
@behemphi
@stackengin
M I C R O -
S E R V I C E S
M I C R O - T E A M S
• Docker makes micro-
service philosophy
available to mere mortals
• Containers are
infrastructure boundaries
for services
• Extraordinary business for
early adopters.
• Terrifying
@behemphi
@stackengin
- T H E U N E N L I G H T E N E D ?
“Developer freedom is antithetical to practical
security”
Docker Docker - Docker Security - Docker
@behemphi
@stackengin
P R O C E S S
D E N S I T Y
• ~2.2% of US power is data
centers.
http://goo.gl/1TBdd7
@behemphi
@stackengin
P R O C E S S
D E N S I T Y
• ~2.2% of US power is data
centers.
• Docker adoptions are
cutting infrastructure
spend by 50% to 80%
http://goo.gl/vB4UDF
@behemphi
@stackengin
P R O C E S S
D E N S I T Y
• ~2.2% of US power is data
centers.
• Docker adoptions are
cutting infrastructure
spend by 50% to 80%
• Density comes with its own
problems
@behemphi
@stackengin
– D E V O P S
“Lessons learned from early Ops adoption will
inform security efforts.”
Docker Docker - Docker Security - Docker
@behemphi
@stackengin
Q U I C K S U M M A R Y
• Significant business advantages
• Cost Savings
• linux.com - https://goo.gl/CJM6ZX
• Increase feature velocity
• Increase innovation
• Reduce communication friction
• Understand the pitfalls and plan for them
• Don’t reject new, make it better
@behemphi
@stackengin
– D O C K E R A N D $ 1 , 0 0 0 , 0 0 0 , 0 0 0
“Docker is worthy of your consideration.”
Docker Docker - Docker Security - Docker
@behemphi
@stackengin
I D E N T I T Y
M A N A G E M E N
T
• You are root and so is
anyone else who can
`docker run`
@behemphi
@stackengin
I D E N T I T Y
M A N A G E M E N
T
• You are root and so is
anyone else who can
`docker run`
• Orchestration tools such a
StackEngine address this.
@behemphi
@stackengin
I D E N T I T Y
M A N A G E M E N
T
• You are root and so is
anyone else who can
`docker run`
• Orchestration tools such a
StackEngine address this.
• Look for ACLs at the API,
CLI and GUI levels.
@behemphi
@stackengin
– S O M E B A D A C T O R
O R
- S O M E D E V E L O P E R W I T H A G O O D I D E A
`docker run --privileged --entrypoint "rm -rf /root" -v
/root:/root:rw stackhub/haproxy`
H T T P : / / G O O . G L / U H I K P R
@behemphi
@stackengin
I M A G E
V E R I F I C A T I O
N
• This is not a new problem
@behemphi
@stackengin
I M A G E
V E R I F I C A T I O
N
• This is not a new problem
• Docker Content Trust
@behemphi
@stackengin
I M A G E
V E R I F I C A T I O
N
• This is not a new problem
• Docker Content Trust
• Caveats:
• Not enabled by default
• Image authors must
make the effort
http://goo.gl/lU7zLk
@behemphi
@stackengin
D O C K E R A S A
H Y P E R V I S O R
• Venom
http://goo.gl/4VyTKv
@behemphi
@stackengin
D O C K E R A S A
H Y P E R V I S O R
• Venom
• Battle Hardening
Project Inception Date
Docker 2013
Xen 2003
KVM 2005
@behemphi
@stackengin
D O C K E R A S A
H Y P E R V I S O R
• Venom
• Battle Hardening
• Complexity - Lines of Code
Project
Lines of
Code
Reference
Docker 300k goo.gl/m8lIn0
Xen 500k goo.gl/xu2uVc
KVM 13,500k goo.gl/9wSPM7
@behemphi
@stackengin
D O C K E R A S A
H Y P E R V I S O R
• Venom
• Battle Hardening
• Complexity - Lines of Code
• Code Churn
D O C K E R
X E N
D O C K E R L A N G
K V M
@behemphi
@stackengin
D O C K E R A S A
H Y P E R V I S O R
• Venom
• Battle Hardening
• Complexity - Lines of Code
• Code Churn
• Rate of Change
Project
Commits per month - previous
12 months
Docker 627
Xen 204
KVM 5894
@behemphi
@stackengin
D O C K E R A S A
H Y P E R V I S O R
• Venom
• Battle Hardening
• Complexity - Lines of Code
• Code Churn
• Rate of Change
• Contributors
Project
Contributors - previous 12
months
Docker 634
Xen 116
KVM 3580
Project
Incep-
tion
Lines of
Code
churn
Commits
per
month
Contri-
buters
Docker 2013 300k 627 634
Xen 2003 500k 204 116
KVM 2005 13,500k 5894 3580
@behemphi
@stackengin
– B O Y D H E M P H I L L
“If nothing else, running Docker in a Hypervisor as
a security measure should be considered more
closely. Thanks https://www.openhub.net/ !”
@behemphi
@stackengin
B L A C K B O X T E S T I N G
@behemphi
@stackengin
D E V O P S 2 . 0
• Ops is a bottleneck, then
DevOps
@behemphi
@stackengin
D E V O P S 2 . 0
• Ops is a bottleneck, then
DevOps
• Sec is a bottleneck, now
DevSec
@behemphi
@stackengin
D E V O P S 2 . 0
• Ops is a bottleneck, then
DevOps
• Sec is a bottleneck, now
DevSec
• Black Box testing with full
cheats
@behemphi
@stackengin
D E V O P S 2 . 0
• Ops is a bottleneck, then
DevOps
• Sec is a bottleneck, now
DevSec
• Black Box testing with full
cheats
• Security is a form of
Quailty. Move it as far to
the front of the SDLC as
possible.
@behemphi
@stackengin
D E V O P S 2 . 0
• Ops is a bottleneck, then
DevOps
• Sec is a bottleneck, now
DevSec
• Black Box testing with full cheats
• Security is a form of Quailty.
Move it as far to the front of the
SDLC as possible.
• Attack yourself, make it a game
and build it in to daily workflows.
@behemphi
@stackengin
– P A R A P H R A S I N G A D R I A N C O C K C R O F T
“Attack yourself, celebrate your breaches. ”
Docker Docker - Docker Security - Docker
@behemphi
@stackengin
S T R A N G L E R
P A T T E R N
• http://goo.gl/YkrgqE
• Replace one thing at a
time and do it well
@behemphi
@stackengin
“Evolution, not revolution. Revolutions are bloody
and never achieve the original goal. ”
@stackengin
e
@behemphi– J O H N N Y A P P L E S E E D
“Questions, comments, tomatoes?”
Ad

Recommended

Container Days NYC Keynote
Container Days NYC Keynote
Boyd Hemphill
 
How's it Going?
How's it Going?
bibliomation
 
TechSEO Boost 2017: The State of Technical SEO
TechSEO Boost 2017: The State of Technical SEO
Catalyst
 
TechSEO Boost 2018: The Statelessness of Technical SEO
TechSEO Boost 2018: The Statelessness of Technical SEO
Catalyst
 
From DevTestOops to DevTestOps
From DevTestOops to DevTestOps
Alex Soto
 
Deployments in one click!
Deployments in one click!
Manuel de la Peña Peña
 
Testing in Production: From DevTestOops to DevTestOps
Testing in Production: From DevTestOops to DevTestOps
Alex Soto
 
Microservices testing and automation
Microservices testing and automation
Alex Soto
 
2020 06-03 cukenfest-bdd-and-sl_os
2020 06-03 cukenfest-bdd-and-sl_os
Abigail Bangser
 
Observability - Experiencing the “why” behind the jargon (FlowCon 2019)
Observability - Experiencing the “why” behind the jargon (FlowCon 2019)
Abigail Bangser
 
TechSEO Boost 2017: Making the Web Fast
TechSEO Boost 2017: Making the Web Fast
Catalyst
 
2020 10-08 measuring-qualityinproduction
2020 10-08 measuring-qualityinproduction
Abigail Bangser
 
Why Accessibility is More Than Just a Lighthouse Metric | SEONerdSwitzerland ...
Why Accessibility is More Than Just a Lighthouse Metric | SEONerdSwitzerland ...
Ruth Everett
 
Machine Learning and Python For Marketing Automation | MKGO October 2019 | Ru...
Machine Learning and Python For Marketing Automation | MKGO October 2019 | Ru...
Ruth Everett
 
TechSEO Boost 2017: SEO Best Practices for JavaScript T-Based Websites
TechSEO Boost 2017: SEO Best Practices for JavaScript T-Based Websites
Catalyst
 
In graph we trust: Microservices, GraphQL and security challenges
In graph we trust: Microservices, GraphQL and security challenges
Mohammed A. Imran
 
Asynchronous processing with PHP and Symfony2. Do it simple
Asynchronous processing with PHP and Symfony2. Do it simple
Kirill Chebunin
 
Inbound 2017: Back to Our Roots with Technical SEO
Inbound 2017: Back to Our Roots with Technical SEO
Stephanie Wallace
 
Data Driven DevOps
Data Driven DevOps
Leon Stigter
 
NLP for SEO
NLP for SEO
Catalyst
 
Debugging Effectively - ConFoo Montreal 2019
Debugging Effectively - ConFoo Montreal 2019
Colin O'Dell
 
Performance tuning
Performance tuning
Eric Phan
 
Debugging Effectively - DrupalCon Nashville 2018
Debugging Effectively - DrupalCon Nashville 2018
Colin O'Dell
 
Candies for everybody: Hacking from 9 to 6
Candies for everybody: Hacking from 9 to 6
Alberto López Martín
 
DESIGN West 2013 Presentation: Accelerating Android Development and Delivery
DESIGN West 2013 Presentation: Accelerating Android Development and Delivery
David Rosen
 
Python For Technical SEO | Women In Tech SEO Festival March 2020 | Ruth Everett
Python For Technical SEO | Women In Tech SEO Festival March 2020 | Ruth Everett
Ruth Everett
 
How Agile Technical SEO Can Add Value To Your SEO Campaign, by Adam Gent
How Agile Technical SEO Can Add Value To Your SEO Campaign, by Adam Gent
Branded3
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy Person
Philip Tellis
 
Social Bite Build A Village - Edinburgh
Social Bite Build A Village - Edinburgh
Marcus Kneen
 
Presentación11
Presentación11
Solorzano Nova
 

More Related Content

What's hot (20)

2020 06-03 cukenfest-bdd-and-sl_os
2020 06-03 cukenfest-bdd-and-sl_os
Abigail Bangser
 
Observability - Experiencing the “why” behind the jargon (FlowCon 2019)
Observability - Experiencing the “why” behind the jargon (FlowCon 2019)
Abigail Bangser
 
TechSEO Boost 2017: Making the Web Fast
TechSEO Boost 2017: Making the Web Fast
Catalyst
 
2020 10-08 measuring-qualityinproduction
2020 10-08 measuring-qualityinproduction
Abigail Bangser
 
Why Accessibility is More Than Just a Lighthouse Metric | SEONerdSwitzerland ...
Why Accessibility is More Than Just a Lighthouse Metric | SEONerdSwitzerland ...
Ruth Everett
 
Machine Learning and Python For Marketing Automation | MKGO October 2019 | Ru...
Machine Learning and Python For Marketing Automation | MKGO October 2019 | Ru...
Ruth Everett
 
TechSEO Boost 2017: SEO Best Practices for JavaScript T-Based Websites
TechSEO Boost 2017: SEO Best Practices for JavaScript T-Based Websites
Catalyst
 
In graph we trust: Microservices, GraphQL and security challenges
In graph we trust: Microservices, GraphQL and security challenges
Mohammed A. Imran
 
Asynchronous processing with PHP and Symfony2. Do it simple
Asynchronous processing with PHP and Symfony2. Do it simple
Kirill Chebunin
 
Inbound 2017: Back to Our Roots with Technical SEO
Inbound 2017: Back to Our Roots with Technical SEO
Stephanie Wallace
 
Data Driven DevOps
Data Driven DevOps
Leon Stigter
 
NLP for SEO
NLP for SEO
Catalyst
 
Debugging Effectively - ConFoo Montreal 2019
Debugging Effectively - ConFoo Montreal 2019
Colin O'Dell
 
Performance tuning
Performance tuning
Eric Phan
 
Debugging Effectively - DrupalCon Nashville 2018
Debugging Effectively - DrupalCon Nashville 2018
Colin O'Dell
 
Candies for everybody: Hacking from 9 to 6
Candies for everybody: Hacking from 9 to 6
Alberto López Martín
 
DESIGN West 2013 Presentation: Accelerating Android Development and Delivery
DESIGN West 2013 Presentation: Accelerating Android Development and Delivery
David Rosen
 
Python For Technical SEO | Women In Tech SEO Festival March 2020 | Ruth Everett
Python For Technical SEO | Women In Tech SEO Festival March 2020 | Ruth Everett
Ruth Everett
 
How Agile Technical SEO Can Add Value To Your SEO Campaign, by Adam Gent
How Agile Technical SEO Can Add Value To Your SEO Campaign, by Adam Gent
Branded3
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy Person
Philip Tellis
 
2020 06-03 cukenfest-bdd-and-sl_os
2020 06-03 cukenfest-bdd-and-sl_os
Abigail Bangser
 
Observability - Experiencing the “why” behind the jargon (FlowCon 2019)
Observability - Experiencing the “why” behind the jargon (FlowCon 2019)
Abigail Bangser
 
TechSEO Boost 2017: Making the Web Fast
TechSEO Boost 2017: Making the Web Fast
Catalyst
 
2020 10-08 measuring-qualityinproduction
2020 10-08 measuring-qualityinproduction
Abigail Bangser
 
Why Accessibility is More Than Just a Lighthouse Metric | SEONerdSwitzerland ...
Why Accessibility is More Than Just a Lighthouse Metric | SEONerdSwitzerland ...
Ruth Everett
 
Machine Learning and Python For Marketing Automation | MKGO October 2019 | Ru...
Machine Learning and Python For Marketing Automation | MKGO October 2019 | Ru...
Ruth Everett
 
TechSEO Boost 2017: SEO Best Practices for JavaScript T-Based Websites
TechSEO Boost 2017: SEO Best Practices for JavaScript T-Based Websites
Catalyst
 
In graph we trust: Microservices, GraphQL and security challenges
In graph we trust: Microservices, GraphQL and security challenges
Mohammed A. Imran
 
Asynchronous processing with PHP and Symfony2. Do it simple
Asynchronous processing with PHP and Symfony2. Do it simple
Kirill Chebunin
 
Inbound 2017: Back to Our Roots with Technical SEO
Inbound 2017: Back to Our Roots with Technical SEO
Stephanie Wallace
 
Data Driven DevOps
Data Driven DevOps
Leon Stigter
 
NLP for SEO
NLP for SEO
Catalyst
 
Debugging Effectively - ConFoo Montreal 2019
Debugging Effectively - ConFoo Montreal 2019
Colin O'Dell
 
Performance tuning
Performance tuning
Eric Phan
 
Debugging Effectively - DrupalCon Nashville 2018
Debugging Effectively - DrupalCon Nashville 2018
Colin O'Dell
 
Candies for everybody: Hacking from 9 to 6
Candies for everybody: Hacking from 9 to 6
Alberto López Martín
 
DESIGN West 2013 Presentation: Accelerating Android Development and Delivery
DESIGN West 2013 Presentation: Accelerating Android Development and Delivery
David Rosen
 
Python For Technical SEO | Women In Tech SEO Festival March 2020 | Ruth Everett
Python For Technical SEO | Women In Tech SEO Festival March 2020 | Ruth Everett
Ruth Everett
 
How Agile Technical SEO Can Add Value To Your SEO Campaign, by Adam Gent
How Agile Technical SEO Can Add Value To Your SEO Campaign, by Adam Gent
Branded3
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy Person
Philip Tellis
 

Viewers also liked (10)

Social Bite Build A Village - Edinburgh
Social Bite Build A Village - Edinburgh
Marcus Kneen
 
Presentación11
Presentación11
Solorzano Nova
 
Glenn Edwards: 'Defining the feral camel problem'. Reducing feral camel impac...
Glenn Edwards: 'Defining the feral camel problem'. Reducing feral camel impac...
Ninti_One
 
ASOBOSQUE
ASOBOSQUE
Distrito de Riego Asobosque
 
Building a Compelling Business Case for Continuous Delivery
Building a Compelling Business Case for Continuous Delivery
XebiaLabs
 
Daniel O' Connell
Daniel O' Connell
Seomra Ranga
 
Bloomberg Brief, Hedge Funds
Bloomberg Brief, Hedge Funds
David Dent
 
Matplotlib 簡介與使用
Matplotlib 簡介與使用
Vic Yang
 
resume 3
resume 3
Joseph Jackson IV
 
Kubernetes and lastminute.com: our course towards better scalability and proc...
Kubernetes and lastminute.com: our course towards better scalability and proc...
Michele Orsi
 
Social Bite Build A Village - Edinburgh
Social Bite Build A Village - Edinburgh
Marcus Kneen
 
Glenn Edwards: 'Defining the feral camel problem'. Reducing feral camel impac...
Glenn Edwards: 'Defining the feral camel problem'. Reducing feral camel impac...
Ninti_One
 
Building a Compelling Business Case for Continuous Delivery
Building a Compelling Business Case for Continuous Delivery
XebiaLabs
 
Bloomberg Brief, Hedge Funds
Bloomberg Brief, Hedge Funds
David Dent
 
Matplotlib 簡介與使用
Matplotlib 簡介與使用
Vic Yang
 
Kubernetes and lastminute.com: our course towards better scalability and proc...
Kubernetes and lastminute.com: our course towards better scalability and proc...
Michele Orsi
 
Ad

Similar to Docker Docker - Docker Security - Docker (20)

DockerCon EU 2015: Day 1 General Session
DockerCon EU 2015: Day 1 General Session
Docker, Inc.
 
StackEngine Problem Space Demo
StackEngine Problem Space Demo
Boyd Hemphill
 
What's New in Docker - February 2017
What's New in Docker - February 2017
Patrick Chanezon
 
codemotion-docker-2014
codemotion-docker-2014
Carlo Bonamico
 
Orchestrating docker containers at scale (#DockerKRK edition)
Orchestrating docker containers at scale (#DockerKRK edition)
Maciej Lasyk
 
5GCroCo_DockerSecurityBasics_Training.pdf
5GCroCo_DockerSecurityBasics_Training.pdf
MaghsoudAbbasPour1
 
Removing Environmental Differences - Simon Pearson
Removing Environmental Differences - Simon Pearson
Outlyer
 
App sec in the time of docker containers
App sec in the time of docker containers
Akash Mahajan
 
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
Codemotion
 
Introduction to Docker at Glidewell Laboratories in Orange County
Introduction to Docker at Glidewell Laboratories in Orange County
Jérôme Petazzoni
 
Using Docker in production: Get started today!
Using Docker in production: Get started today!
Clarence Bakirtzidis
 
Docker Roadshow 2016
Docker Roadshow 2016
Docker, Inc.
 
How to create your own hack environment
How to create your own hack environment
Sumedt Jitpukdebodin
 
Be a better developer with Docker (revision 3)
Be a better developer with Docker (revision 3)
Nicola Paolucci
 
The Docker Ecosystem
The Docker Ecosystem
Dmitry Skaredov
 
DockerPenang Meetup#1
DockerPenang Meetup#1
Sujay Pillai
 
Blue Whale in an Enterprise Pond
Blue Whale in an Enterprise Pond
Digia Plc
 
Docker Tips And Tricks at the Docker Beijing Meetup
Docker Tips And Tricks at the Docker Beijing Meetup
Jérôme Petazzoni
 
Docker 1 0 1 0 1: a Docker introduction, actualized for the stable release of...
Docker 1 0 1 0 1: a Docker introduction, actualized for the stable release of...
Jérôme Petazzoni
 
Taking Control of Chaos with Docker and Puppet
Taking Control of Chaos with Docker and Puppet
Puppet
 
DockerCon EU 2015: Day 1 General Session
DockerCon EU 2015: Day 1 General Session
Docker, Inc.
 
StackEngine Problem Space Demo
StackEngine Problem Space Demo
Boyd Hemphill
 
What's New in Docker - February 2017
What's New in Docker - February 2017
Patrick Chanezon
 
codemotion-docker-2014
codemotion-docker-2014
Carlo Bonamico
 
Orchestrating docker containers at scale (#DockerKRK edition)
Orchestrating docker containers at scale (#DockerKRK edition)
Maciej Lasyk
 
5GCroCo_DockerSecurityBasics_Training.pdf
5GCroCo_DockerSecurityBasics_Training.pdf
MaghsoudAbbasPour1
 
Removing Environmental Differences - Simon Pearson
Removing Environmental Differences - Simon Pearson
Outlyer
 
App sec in the time of docker containers
App sec in the time of docker containers
Akash Mahajan
 
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
Codemotion
 
Introduction to Docker at Glidewell Laboratories in Orange County
Introduction to Docker at Glidewell Laboratories in Orange County
Jérôme Petazzoni
 
Using Docker in production: Get started today!
Using Docker in production: Get started today!
Clarence Bakirtzidis
 
Docker Roadshow 2016
Docker Roadshow 2016
Docker, Inc.
 
How to create your own hack environment
How to create your own hack environment
Sumedt Jitpukdebodin
 
Be a better developer with Docker (revision 3)
Be a better developer with Docker (revision 3)
Nicola Paolucci
 
DockerPenang Meetup#1
DockerPenang Meetup#1
Sujay Pillai
 
Blue Whale in an Enterprise Pond
Blue Whale in an Enterprise Pond
Digia Plc
 
Docker Tips And Tricks at the Docker Beijing Meetup
Docker Tips And Tricks at the Docker Beijing Meetup
Jérôme Petazzoni
 
Docker 1 0 1 0 1: a Docker introduction, actualized for the stable release of...
Docker 1 0 1 0 1: a Docker introduction, actualized for the stable release of...
Jérôme Petazzoni
 
Taking Control of Chaos with Docker and Puppet
Taking Control of Chaos with Docker and Puppet
Puppet
 
Ad

More from Boyd Hemphill (20)

Longhorn PHP Tech Debt
Longhorn PHP Tech Debt
Boyd Hemphill
 
2022-08-16-cloud-austin-tech-debt.pdf
2022-08-16-cloud-austin-tech-debt.pdf
Boyd Hemphill
 
The Dynamic Duo
The Dynamic Duo
Boyd Hemphill
 
Risk is not Fear
Risk is not Fear
Boyd Hemphill
 
Longhorn PHP - Stop Doing It Wrong
Longhorn PHP - Stop Doing It Wrong
Boyd Hemphill
 
Deploying PHP Applications to AWS Elastic Beanstalk
Deploying PHP Applications to AWS Elastic Beanstalk
Boyd Hemphill
 
2017-10-24 All Day DevOps - Disposable Development Environments
2017-10-24 All Day DevOps - Disposable Development Environments
Boyd Hemphill
 
HomeOps - Reasoning About DevOps at Home
HomeOps - Reasoning About DevOps at Home
Boyd Hemphill
 
Container Day - Seattle
Container Day - Seattle
Boyd Hemphill
 
Docker enables agile_devops
Docker enables agile_devops
Boyd Hemphill
 
Openstack Summit Container Day Keynote
Openstack Summit Container Day Keynote
Boyd Hemphill
 
Laundryops Practical DevOps at Home
Laundryops Practical DevOps at Home
Boyd Hemphill
 
Ten Book, Five Minutes
Ten Book, Five Minutes
Boyd Hemphill
 
Keep calms and Docker On ... Innotech
Keep calms and Docker On ... Innotech
Boyd Hemphill
 
Docker Enables DevOps - Keep C.A.L.M.S. and Docker on ...
Docker Enables DevOps - Keep C.A.L.M.S. and Docker on ...
Boyd Hemphill
 
StackEngine Demo - Boston
StackEngine Demo - Boston
Boyd Hemphill
 
Docker Enables DevOps - Boston
Docker Enables DevOps - Boston
Boyd Hemphill
 
StackEngine Demo - Docker Austin
StackEngine Demo - Docker Austin
Boyd Hemphill
 
StackEngine Problem Space Demo
StackEngine Problem Space Demo
Boyd Hemphill
 
Docker Enables DevOps
Docker Enables DevOps
Boyd Hemphill
 
Longhorn PHP Tech Debt
Longhorn PHP Tech Debt
Boyd Hemphill
 
2022-08-16-cloud-austin-tech-debt.pdf
2022-08-16-cloud-austin-tech-debt.pdf
Boyd Hemphill
 
Longhorn PHP - Stop Doing It Wrong
Longhorn PHP - Stop Doing It Wrong
Boyd Hemphill
 
Deploying PHP Applications to AWS Elastic Beanstalk
Deploying PHP Applications to AWS Elastic Beanstalk
Boyd Hemphill
 
2017-10-24 All Day DevOps - Disposable Development Environments
2017-10-24 All Day DevOps - Disposable Development Environments
Boyd Hemphill
 
HomeOps - Reasoning About DevOps at Home
HomeOps - Reasoning About DevOps at Home
Boyd Hemphill
 
Container Day - Seattle
Container Day - Seattle
Boyd Hemphill
 
Docker enables agile_devops
Docker enables agile_devops
Boyd Hemphill
 
Openstack Summit Container Day Keynote
Openstack Summit Container Day Keynote
Boyd Hemphill
 
Laundryops Practical DevOps at Home
Laundryops Practical DevOps at Home
Boyd Hemphill
 
Ten Book, Five Minutes
Ten Book, Five Minutes
Boyd Hemphill
 
Keep calms and Docker On ... Innotech
Keep calms and Docker On ... Innotech
Boyd Hemphill
 
Docker Enables DevOps - Keep C.A.L.M.S. and Docker on ...
Docker Enables DevOps - Keep C.A.L.M.S. and Docker on ...
Boyd Hemphill
 
StackEngine Demo - Boston
StackEngine Demo - Boston
Boyd Hemphill
 
Docker Enables DevOps - Boston
Docker Enables DevOps - Boston
Boyd Hemphill
 
StackEngine Demo - Docker Austin
StackEngine Demo - Docker Austin
Boyd Hemphill
 
StackEngine Problem Space Demo
StackEngine Problem Space Demo
Boyd Hemphill
 
Docker Enables DevOps
Docker Enables DevOps
Boyd Hemphill
 

Recently uploaded (20)

From Manual to Auto Searching- FME in the Driver's Seat
From Manual to Auto Searching- FME in the Driver's Seat
Safe Software
 
Security Tips for Enterprise Azure Solutions
Security Tips for Enterprise Azure Solutions
Michele Leroux Bustamante
 
AI VIDEO MAGAZINE - June 2025 - r/aivideo
AI VIDEO MAGAZINE - June 2025 - r/aivideo
1pcity Studios, Inc
 
Smarter Aviation Data Management: Lessons from Swedavia Airports and Sweco
Smarter Aviation Data Management: Lessons from Swedavia Airports and Sweco
Safe Software
 
Wenn alles versagt - IBM Tape schützt, was zählt! Und besonders mit dem neust...
Wenn alles versagt - IBM Tape schützt, was zählt! Und besonders mit dem neust...
Josef Weingand
 
Tech-ASan: Two-stage check for Address Sanitizer - Yixuan Cao.pdf
Tech-ASan: Two-stage check for Address Sanitizer - Yixuan Cao.pdf
caoyixuan2019
 
OWASP Barcelona 2025 Threat Model Library
OWASP Barcelona 2025 Threat Model Library
PetraVukmirovic
 
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
pcprocore
 
cnc-processing-centers-centateq-p-110-en.pdf
cnc-processing-centers-centateq-p-110-en.pdf
AmirStern2
 
The Future of Technology: 2025-2125 by Saikat Basu.pdf
The Future of Technology: 2025-2125 by Saikat Basu.pdf
Saikat Basu
 
Cyber Defense Matrix Workshop - RSA Conference
Cyber Defense Matrix Workshop - RSA Conference
Priyanka Aash
 
Coordinated Disclosure for ML - What's Different and What's the Same.pdf
Coordinated Disclosure for ML - What's Different and What's the Same.pdf
Priyanka Aash
 
The Future of Product Management in AI ERA.pdf
The Future of Product Management in AI ERA.pdf
Alyona Owens
 
AI vs Human Writing: Can You Tell the Difference?
AI vs Human Writing: Can You Tell the Difference?
Shashi Sathyanarayana, Ph.D
 
Connecting Data and Intelligence: The Role of FME in Machine Learning
Connecting Data and Intelligence: The Role of FME in Machine Learning
Safe Software
 
“MPU+: A Transformative Solution for Next-Gen AI at the Edge,” a Presentation...
“MPU+: A Transformative Solution for Next-Gen AI at the Edge,” a Presentation...
Edge AI and Vision Alliance
 
PyCon SG 25 - Firecracker Made Easy with Python.pdf
PyCon SG 25 - Firecracker Made Easy with Python.pdf
Muhammad Yuga Nugraha
 
Mastering AI Workflows with FME by Mark Döring
Mastering AI Workflows with FME by Mark Döring
Safe Software
 
Python Conference Singapore - 19 Jun 2025
Python Conference Singapore - 19 Jun 2025
ninefyi
 
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
Priyanka Aash
 
From Manual to Auto Searching- FME in the Driver's Seat
From Manual to Auto Searching- FME in the Driver's Seat
Safe Software
 
Security Tips for Enterprise Azure Solutions
Security Tips for Enterprise Azure Solutions
Michele Leroux Bustamante
 
AI VIDEO MAGAZINE - June 2025 - r/aivideo
AI VIDEO MAGAZINE - June 2025 - r/aivideo
1pcity Studios, Inc
 
Smarter Aviation Data Management: Lessons from Swedavia Airports and Sweco
Smarter Aviation Data Management: Lessons from Swedavia Airports and Sweco
Safe Software
 
Wenn alles versagt - IBM Tape schützt, was zählt! Und besonders mit dem neust...
Wenn alles versagt - IBM Tape schützt, was zählt! Und besonders mit dem neust...
Josef Weingand
 
Tech-ASan: Two-stage check for Address Sanitizer - Yixuan Cao.pdf
Tech-ASan: Two-stage check for Address Sanitizer - Yixuan Cao.pdf
caoyixuan2019
 
OWASP Barcelona 2025 Threat Model Library
OWASP Barcelona 2025 Threat Model Library
PetraVukmirovic
 
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
CapCut Pro Crack For PC Latest Version {Fully Unlocked} 2025
pcprocore
 
cnc-processing-centers-centateq-p-110-en.pdf
cnc-processing-centers-centateq-p-110-en.pdf
AmirStern2
 
The Future of Technology: 2025-2125 by Saikat Basu.pdf
The Future of Technology: 2025-2125 by Saikat Basu.pdf
Saikat Basu
 
Cyber Defense Matrix Workshop - RSA Conference
Cyber Defense Matrix Workshop - RSA Conference
Priyanka Aash
 
Coordinated Disclosure for ML - What's Different and What's the Same.pdf
Coordinated Disclosure for ML - What's Different and What's the Same.pdf
Priyanka Aash
 
The Future of Product Management in AI ERA.pdf
The Future of Product Management in AI ERA.pdf
Alyona Owens
 
AI vs Human Writing: Can You Tell the Difference?
AI vs Human Writing: Can You Tell the Difference?
Shashi Sathyanarayana, Ph.D
 
Connecting Data and Intelligence: The Role of FME in Machine Learning
Connecting Data and Intelligence: The Role of FME in Machine Learning
Safe Software
 
“MPU+: A Transformative Solution for Next-Gen AI at the Edge,” a Presentation...
“MPU+: A Transformative Solution for Next-Gen AI at the Edge,” a Presentation...
Edge AI and Vision Alliance
 
PyCon SG 25 - Firecracker Made Easy with Python.pdf
PyCon SG 25 - Firecracker Made Easy with Python.pdf
Muhammad Yuga Nugraha
 
Mastering AI Workflows with FME by Mark Döring
Mastering AI Workflows with FME by Mark Döring
Safe Software
 
Python Conference Singapore - 19 Jun 2025
Python Conference Singapore - 19 Jun 2025
ninefyi
 
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
GenAI Opportunities and Challenges - Where 370 Enterprises Are Focusing Now.pdf
Priyanka Aash
 

Docker Docker - Docker Security - Docker

  • 1. @behemphi @stackengin e D O C K E R D O C K E R D O C K E R … S E C U R I T Y … D O C K E R B O Y D H E M P H I L L , D I R E C T O R O F E V A N G E L I S M
  • 3. @behemphi @stackengin G O A L S • Understand Why Docker is Such a Big Deal Love to @petecheslock
  • 4. @behemphi @stackengin G O A L S • Understand Why Docker is Such a Big Deal • Consider Docker Security Concerns Love to @petecheslock
  • 5. @behemphi @stackengin G O A L S • Understand Why Docker is Such a Big Deal • Consider Docker Security Concerns • Ponder a Rational Docker Adoption Strategy Love to @petecheslock
  • 6. @behemphi @stackengin – B O Y D H E M P H I L L “As and Ops director, I am personally guilty of pooping rainbows on security concerns.”
  • 8. @behemphi @stackengin W H O A M I ? • Technologist
  • 9. @behemphi @stackengin W H O A M I ? • Technologist • Community Builder
  • 10. @behemphi @stackengin W H O A M I ? • Technologist • Community Builder • Extroverted Nerd
  • 11. @behemphi @stackengin W H O A M I ? • Technologist • Community Builder • Extroverted Nerd • Evangelist
  • 12. @behemphi @stackengin - T H E A U S T I N D E V O P S C O M M U N I T Y “Come to Docker Austin and Austin DevOps. Your participation will move the conversations towards your passion - security.”
  • 14. @behemphi @stackengin T H I S T H I N G O F W H I C H Y O U S P E A K ? • Docker Docker Docker
  • 15. @behemphi @stackengin T H I S T H I N G O F W H I C H Y O U S P E A K ? • Docker Docker Docker • Orchestration, Service Discovery, Community
  • 16. @behemphi @stackengin T H I S T H I N G O F W H I C H Y O U S P E A K ? • Docker Docker Docker • Orchestration, Service Discovery, Community • Like what you hear? Come join the conversation: http://goo.gl/YyyJOx
  • 17. @behemphi @stackengin - B O B Q U I L L I N - C E O “Buy copious amounts of StackEngine goodness.”
  • 19. @behemphi @stackengin W H O A R E Y O U ? • Have heard of Docker
  • 20. @behemphi @stackengin W H O A R E Y O U ? • Have heard of Docker? • Have experimented with Docker on the job?
  • 21. @behemphi @stackengin W H O A R E Y O U ? • Have heard of Docker? • Have experimented with Docker on the job? • Are using Docker in a production environment?
  • 22. @behemphi @stackengin - S E C U R I T Y H O B B I T S “Unicorns nothing, Balrogs is more like it!”
  • 24. @behemphi @stackengin C O M M O N G R O U N D • Philosophy
  • 25. @behemphi @stackengin C O M M O N G R O U N D • Philosophy • Model
  • 26. @behemphi @stackengin C O M M O N G R O U N D • Philosophy • Model • Implementation
  • 27. @behemphi @stackengin C O M M O N G R O U N D • Philosophy • Model • Implementation • Tooling
  • 29. H T T P S : / / G O O . G L / R T 2 S W F
  • 30. @behemphi @stackengin M I C R O - S E R V I C E S M I C R O - T E A M S • Docker makes micro- service philosophy available to mere mortals
  • 31. @behemphi @stackengin M I C R O - S E R V I C E S M I C R O - T E A M S • Docker makes micro- service philosophy available to mere mortals • Containers are infrastructure boundaries for services
  • 32. @behemphi @stackengin M I C R O - S E R V I C E S M I C R O - T E A M S • Docker makes micro- service philosophy available to mere mortals • Containers are infrastructure boundaries for services • Extraordinary business for early adopters.
  • 33. @behemphi @stackengin M I C R O - S E R V I C E S M I C R O - T E A M S • Docker makes micro- service philosophy available to mere mortals • Containers are infrastructure boundaries for services • Extraordinary business for early adopters. • Terrifying
  • 34. @behemphi @stackengin - T H E U N E N L I G H T E N E D ? “Developer freedom is antithetical to practical security”
  • 36. @behemphi @stackengin P R O C E S S D E N S I T Y • ~2.2% of US power is data centers. http://goo.gl/1TBdd7
  • 37. @behemphi @stackengin P R O C E S S D E N S I T Y • ~2.2% of US power is data centers. • Docker adoptions are cutting infrastructure spend by 50% to 80% http://goo.gl/vB4UDF
  • 38. @behemphi @stackengin P R O C E S S D E N S I T Y • ~2.2% of US power is data centers. • Docker adoptions are cutting infrastructure spend by 50% to 80% • Density comes with its own problems
  • 39. @behemphi @stackengin – D E V O P S “Lessons learned from early Ops adoption will inform security efforts.”
  • 41. @behemphi @stackengin Q U I C K S U M M A R Y • Significant business advantages • Cost Savings • linux.com - https://goo.gl/CJM6ZX • Increase feature velocity • Increase innovation • Reduce communication friction • Understand the pitfalls and plan for them • Don’t reject new, make it better
  • 42. @behemphi @stackengin – D O C K E R A N D $ 1 , 0 0 0 , 0 0 0 , 0 0 0 “Docker is worthy of your consideration.”
  • 44. @behemphi @stackengin I D E N T I T Y M A N A G E M E N T • You are root and so is anyone else who can `docker run`
  • 45. @behemphi @stackengin I D E N T I T Y M A N A G E M E N T • You are root and so is anyone else who can `docker run` • Orchestration tools such a StackEngine address this.
  • 46. @behemphi @stackengin I D E N T I T Y M A N A G E M E N T • You are root and so is anyone else who can `docker run` • Orchestration tools such a StackEngine address this. • Look for ACLs at the API, CLI and GUI levels.
  • 47. @behemphi @stackengin – S O M E B A D A C T O R O R - S O M E D E V E L O P E R W I T H A G O O D I D E A `docker run --privileged --entrypoint "rm -rf /root" -v /root:/root:rw stackhub/haproxy`
  • 48. H T T P : / / G O O . G L / U H I K P R
  • 49. @behemphi @stackengin I M A G E V E R I F I C A T I O N • This is not a new problem
  • 50. @behemphi @stackengin I M A G E V E R I F I C A T I O N • This is not a new problem • Docker Content Trust
  • 51. @behemphi @stackengin I M A G E V E R I F I C A T I O N • This is not a new problem • Docker Content Trust • Caveats: • Not enabled by default • Image authors must make the effort
  • 53. @behemphi @stackengin D O C K E R A S A H Y P E R V I S O R • Venom http://goo.gl/4VyTKv
  • 54. @behemphi @stackengin D O C K E R A S A H Y P E R V I S O R • Venom • Battle Hardening Project Inception Date Docker 2013 Xen 2003 KVM 2005
  • 55. @behemphi @stackengin D O C K E R A S A H Y P E R V I S O R • Venom • Battle Hardening • Complexity - Lines of Code Project Lines of Code Reference Docker 300k goo.gl/m8lIn0 Xen 500k goo.gl/xu2uVc KVM 13,500k goo.gl/9wSPM7
  • 56. @behemphi @stackengin D O C K E R A S A H Y P E R V I S O R • Venom • Battle Hardening • Complexity - Lines of Code • Code Churn D O C K E R X E N D O C K E R L A N G K V M
  • 57. @behemphi @stackengin D O C K E R A S A H Y P E R V I S O R • Venom • Battle Hardening • Complexity - Lines of Code • Code Churn • Rate of Change Project Commits per month - previous 12 months Docker 627 Xen 204 KVM 5894
  • 58. @behemphi @stackengin D O C K E R A S A H Y P E R V I S O R • Venom • Battle Hardening • Complexity - Lines of Code • Code Churn • Rate of Change • Contributors Project Contributors - previous 12 months Docker 634 Xen 116 KVM 3580
  • 59. Project Incep- tion Lines of Code churn Commits per month Contri- buters Docker 2013 300k 627 634 Xen 2003 500k 204 116 KVM 2005 13,500k 5894 3580
  • 60. @behemphi @stackengin – B O Y D H E M P H I L L “If nothing else, running Docker in a Hypervisor as a security measure should be considered more closely. Thanks https://www.openhub.net/ !”
  • 61. @behemphi @stackengin B L A C K B O X T E S T I N G
  • 62. @behemphi @stackengin D E V O P S 2 . 0 • Ops is a bottleneck, then DevOps
  • 63. @behemphi @stackengin D E V O P S 2 . 0 • Ops is a bottleneck, then DevOps • Sec is a bottleneck, now DevSec
  • 64. @behemphi @stackengin D E V O P S 2 . 0 • Ops is a bottleneck, then DevOps • Sec is a bottleneck, now DevSec • Black Box testing with full cheats
  • 65. @behemphi @stackengin D E V O P S 2 . 0 • Ops is a bottleneck, then DevOps • Sec is a bottleneck, now DevSec • Black Box testing with full cheats • Security is a form of Quailty. Move it as far to the front of the SDLC as possible.
  • 66. @behemphi @stackengin D E V O P S 2 . 0 • Ops is a bottleneck, then DevOps • Sec is a bottleneck, now DevSec • Black Box testing with full cheats • Security is a form of Quailty. Move it as far to the front of the SDLC as possible. • Attack yourself, make it a game and build it in to daily workflows.
  • 67. @behemphi @stackengin – P A R A P H R A S I N G A D R I A N C O C K C R O F T “Attack yourself, celebrate your breaches. ”
  • 69. @behemphi @stackengin S T R A N G L E R P A T T E R N • http://goo.gl/YkrgqE • Replace one thing at a time and do it well
  • 70. @behemphi @stackengin “Evolution, not revolution. Revolutions are bloody and never achieve the original goal. ”
  • 71. @stackengin e @behemphi– J O H N N Y A P P L E S E E D “Questions, comments, tomatoes?”