Hacker News Reader

Comment by bloopernova | Hacker News Reader

Figure I would ask here: Have any DevOps or build folks had to deal with compliance audits regarding their docker containers?

It's something certain developers I've encountered seem to ignore, even when creating something that might handle health or financial information.

Did you have to build your docker images from scratch, or did the security audit folks certify upstream images? What about updates?

View on HN

We use Twistlock (https://www.twistlock.com/) as it does the CVE scanning but you can setup rules for compliance, binary monitoring and a whole plethora of other security/auditing type things. It also has a jenkins plugin so you can fail builds if a certain threshold of CVEs/compliance failures are introduced by developers (the only way to actually get the team to care about security).

Our security folks haven't really decided what to do with containers although some people are just using RHEL7 base images since its "enterprise-y". Our group personally uses alpine base images. If we have something like a java service hosted by Tomcat, we build alpine then build tomcat and then build our "service" container. While most people are fine pulling from Dockerhub, we do work in closed-loop environments and have a private docker registry where we host our "chain" of docker images which are versioned and updated regularly.

Thank you, I will check that out.

Docker actually does this for you via Cloud when you store your images. It performs static analysis of all files/libs in your container to check for vulnerabilities, as opposed to the simpler `dpkg` list check which is not accurate.

Cool, so at least some folks are thinking about this sort of thing. Thank you for the response!

Assuming you have a shell within your container, InSpec can be a great tool (https://www.inspec.io/) as you can pass a "docker" target for your compliance profiles.

Works great for us :)

Gitlab has a bunch of features around this: licensing, package scanning and docker CVE scanning.

Cool, I had no idea. Thank you!

Reply on news.ycombinator.com