bsrx

Any comments on who put this together, or their long term goals?

Signed up, got https://www.hacksplaining.com/profile.json

"Container usage is growing quickly and is carrying more and more of the computing needs, allowing for greater flexibility. We must secure them."

We must do X - any insight into how to do X, or what features X needs to have?

SecOps mission is: prevent, detect, respond.

Yes, outright prevention is important. Yet proper centralized log collection and intelligence helps with all three missions, including prevention.

Proper logging allows you to identify known-good behavior patterns and outlying anomalies. With profiles in place, one can automate blocking of reconnaissance and probes, not just blocking known vulnerabilities.

It may be critically important, but they can't do everything at once. They're moving incredibly fast as it is.

Other people were attempting to solve this problem too - https://registry.hub.docker.com/u/kiyoto/docker-fluentd/

The logging drivers reduce a major production pain point - standardized centralized logging that doesn't require modifying the underlying image.

Docker has a bad security reputation; this is one more step in the right direction.

Other than privilege escalation through the kernel, what attack surface do you see exposed?

Might just be limited to my use case for Docker, but so far it's security agnostic.

What are your security concerns regarding Docker? Or what do you perceive to be common security flaws?

So far I've perceived Docker to be like virtualenv for python - useful but orthogonal to any security practices.