Answers: <h1>2017 expectations</h1>
  
  <p>Docker is about getting some freedom from host management at the expense of reinventing all the things package management does. Docker images are just another package format. This is all very new, so I think this question is part of the growing pains of the Docker ecosystem.</p>
  
  <h2>basic requirements/criteria</h2>
  
  <p>For secure trusted containers, only use them if they have been 
   1. tested by current standards 
   2. cryptographically signed 
   3. checked against a vulnerability database for insecure dependencies</p>
  
  <p>Maybe there is a way, but I don't see a way to un-trust a signed, trusted Docker image after a researcher finds a new vulnerability. This is just one gap in the toolset cited in the question.</p>
  
  <p>Are you planning to use a cloud Docker service? Are the containers' memory encrypted or at least obfuscated at the kernel (containers are just processes)?</p>
  
  <h2>Are your Docker hosts secure?</h2>
  
  <p><a href="http://ieeexplore.ieee.org/document/7562068/" rel="nofollow noreferrer">http://ieeexplore.ieee.org/document/7562068/</a>
  <a href="http://ieeexplore.ieee.org/document/7397244/" rel="nofollow noreferrer">http://ieeexplore.ieee.org/document/7397244/</a></p>
  
  <h1>economy of security</h1>
  
  <p>In the end, you can never escape the economics of checking everything, so there needs to be some respect paid to the speed Docker provides by not worrying about all of this stuff. When you know you are handling sensitive information and you know you need to lock down the execution, it will require measures that are not available yet as commodity solutions (2017). Anything is better than nothing, so get some tools deployed and get your foot in the door.</p>
  
  <h2>Hubblestack?</h2>
  
  <p>Keep your eye on <a href="https://hubblestack.io/" rel="nofollow noreferrer">HubbleStack</a>. It provides a Docker image which can be dropped in to run audits (and remediations) against a live database of vulnerabilities. I'd be surprised if they left Docker trust out of scope forever. Also, if you own the Docker hosts, you can use root to scan all the containers. This kind of thing belongs in the DevOps automated test and validation cycle.</p>
  
  <ol>
  <li>get some kind of checkpoint in place to get security in the pipeline</li>
  <li>keep a backlog of unmanaged security concerns (gaps in the tools? CVEs?)</li>
  <li>keep the backlog prioritized by what you can get done now, at current funding</li>
  <li>get involved in devops development and release planning</li>
  <li>deliver software confident that you did the best with the resources you had</li>
  </ol>
  
Answers: CC BY-SA 3.0
Answers: 2017-12-14T22:00:17.330Z
Answers: 2017-12-14T22:00:17.330Z
Answers: Jeremy
Body: <p>I'm interested in information and experiences surrounding Docker security. I'd like to understand ways that a user/client could validate the contents of an image to ensure that the packaged applications/files are in compliance with their organization's/industry standard practices.</p>
  
  <p>I've been reading online about security as far as establishing trust to validate the integrity and the publisher of data received from a registry(<a href="https://docs.docker.com/engine/security/trust/content_trust/" rel="nofollow noreferrer">https://docs.docker.com/engine/security/trust/content_trust/</a>), as well as Security Assurance of Docker Containers(<a href="https://www.sans.org/reading-room/whitepapers/cloud/security-assurance-docker-containers-37432" rel="nofollow noreferrer">https://www.sans.org/reading-room/whitepapers/cloud/security-assurance-docker-containers-37432</a>)>, and I see some useful information around tools and practices to validate the security of containers and images. </p>
  
  <p>Some tools I'm interested in exploring more are OpenSCAP docker tool(<a href="https://www.open-scap.org/resources/documentation/security-compliance-of-rhel7-docker-containers/" rel="nofollow noreferrer">https://www.open-scap.org/resources/documentation/security-compliance-of-rhel7-docker-containers/</a>) as well as Docker Bench for Security(<a href="https://github.com/docker/docker-bench-security" rel="nofollow noreferrer">https://github.com/docker/docker-bench-security</a>) and Dockscan(<a href="https://github.com/kost/dockscan" rel="nofollow noreferrer">https://github.com/kost/dockscan</a>).</p>
  
  <p>My question is, does anybody have any experience with dealing with security/compliance when deploying containers and sharing images or considering Docker as a solution for deploying applications internally/to external clients? If so, how would you recommend an organization best approach this topic?</p>
  
Comments: CC BY-SA 3.0
Comments: 2017-12-14T23:05:52.140Z
Comments: Possible duplicate of [What are best and comprehensive practices to consider when running docker in production?](https://devops.stackexchange.com/questions/1943/what-are-best-and-comprehensive-practices-to-consider-when-running-docker-in-pro)
Comments: 030
Tags: <docker><security>
Title: Real-World Validating the Integrity of a Docker Container
UserDisplayName: Glenak1911
ThreadText: # Real-World Validating the Integrity of a Docker Container
  
  (Asked by: username_0 on 2017-12-14)
  
  I'm interested in information and experiences surrounding Docker security. I'd like to understand ways that a user/client could validate the contents of an image to ensure that the packaged applications/files are in compliance with their organization's/industry standard practices.
  
  I've been reading online about security as far as establishing trust to validate the integrity and the publisher of data received from a registry(<https://docs.docker.com/engine/security/trust/content_trust/>), as well as Security Assurance of Docker Containers(<https://www.sans.org/reading-room/whitepapers/cloud/security-assurance-docker-containers-37432>)>, and I see some useful information around tools and practices to validate the security of containers and images.
  
  Some tools I'm interested in exploring more are OpenSCAP docker tool(<https://www.open-scap.org/resources/documentation/security-compliance-of-rhel7-docker-containers/>) as well as Docker Bench for Security(<https://github.com/docker/docker-bench-security>) and Dockscan(<https://github.com/kost/dockscan>).
  
  My question is, does anybody have any experience with dealing with security/compliance when deploying containers and sharing images or considering Docker as a solution for deploying applications internally/to external clients? If so, how would you recommend an organization best approach this topic?
  
  **Tags:** docker, security
  
  > **Comments:**
  > **username_1**: Possible duplicate of [What are best and comprehensive practices to consider when running docker in production?](https://devops.stackexchange.com/questions/1943/what-are-best-and-comprehensive-practices-to-consider-when-running-docker-in-pro)  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2017-12-14. Score: 1 | Accepted answer
  
  # 2017 expectations
  
  Docker is about getting some freedom from host management at the expense of reinventing all the things package management does. Docker images are just another package format. This is all very new, so I think this question is part of the growing pains of the Docker ecosystem.
  
  ## basic requirements/criteria
  
  For secure trusted containers, only use them if they have been
  1. tested by current standards
  2. cryptographically signed
  3. checked against a vulnerability database for insecure dependencies
  
  Maybe there is a way, but I don't see a way to un-trust a signed, trusted Docker image after a researcher finds a new vulnerability. This is just one gap in the toolset cited in the question.
  
  Are you planning to use a cloud Docker service? Are the containers' memory encrypted or at least obfuscated at the kernel (containers are just processes)?
  
  ## Are your Docker hosts secure?
  
  <http://ieeexplore.ieee.org/document/7562068/>
  <http://ieeexplore.ieee.org/document/7397244/>
  
  # economy of security
  
  In the end, you can never escape the economics of checking everything, so there needs to be some respect paid to the speed Docker provides by not worrying about all of this stuff. When you know you are handling sensitive information and you know you need to lock down the execution, it will require measures that are not available yet as commodity solutions (2017). Anything is better than nothing, so get some tools deployed and get your foot in the door.
  
  ## Hubblestack?
  
  Keep your eye on [HubbleStack](https://hubblestack.io/). It provides a Docker image which can be dropped in to run audits (and remediations) against a live database of vulnerabilities. I'd be surprised if they left Docker trust out of scope forever. Also, if you own the Docker hosts, you can use root to scan all the containers. This kind of thing belongs in the DevOps automated test and validation cycle.
  
  1. get some kind of checkpoint in place to get security in the pipeline
  2. keep a backlog of unmanaged security concerns (gaps in the tools? CVEs?)
  3. keep the backlog prioritized by what you can get done now, at current funding
  4. get involved in devops development and release planning
  5. deliver software confident that you did the best with the resources you had
  
  
  ---
  
  