Containerization – Best DevOps

What’s in Your Containers? Try an Open Source Tool to Find Out

anil — Thu, 16 Jan 2020 05:59:11 +0000

Source:-technewsworld.com

As most security pros know, application containers — Docker, rkt, etc. — and the orchestration elements employed to support them, such as Kubernetes, are used increasingly in many organizations.

Often the security organization isn’t exactly the first stop on the path to deployment of these tools. (If it was in your shop, consider yourself one of the lucky ones.) Instead, usage tends to emerge from the grass roots. It starts with developers using containers on their workstations to streamline unit testing and environmental configuration; builds traction as integration processes adapt to a more “continuous integration” approach facilitated by containers; and ultimately gains acceptance in the broader production landscape.

In short, as is often the case, many security pros find out about the usage when their organization is already waist-deep in it.

This puts security practitioners in a bit of a rock-and-a-hard-place situation. Not only do we need to secure the container runtime and orchestration environments — we need to do so at the same time that we provide assurance for the applications, supporting libraries, middleware components, etc., stored inside those containers.

We need to do all of this without sacrificing the quality or rigor of efforts in other areas, while building expertise on the nuances of the different container engines, orchestration environments, microservice architecture approaches, and cloud technologies that support their use.

Sound challenging? You bet it is.

This means that security pros — particularly those on the more technical end of the spectrum — need every advantage they can get when it comes to securing containers. Any “force multiplier” helps: automation, discovery and visibility tools, better monitoring, etc.

There are numerous commercial tools out there that can help in these areas (and in many others), but sometimes you need help right now. You may not be able to wait for a budget cycle to buy a tool off the shelf. In that case, open source options can provide an on-ramp without waiting for budget.

Intertech Ad – Click for more!

What’s in That Container?

Now, there are a few open source tools that are making a splash in the container security world, but the one I’ll focus on here is Anchore Engine, which targets a challenge many organizations have: specifically, unpacking, validating, and providing assurance for container contents.

Anchore Engine is an open source (Apache License 2.0) project that can help you in two ways, out of the box. First, it will give you an analysis of what is inside a given container. This includes providing an inventory of software — both operating system components and supporting packages — and artifacts like JRE versions, intermediate libraries, etc.

“Anchore Engine is an open source tool for performing deep inspection of container images,” said Ross Turk, Anchore VP of marketing. “These images can contain a whole lot: operating system packages, language libraries, credentials and secrets, and configuration that affects how the resulting containers are executed. Anchore Engine flattens and unpacks the image, layer by layer, and inventories what’s inside.”

This information is valuable not only because it provides information on what software may need to be updated in the event of security patches or updates, but also because it gives you visibility into the implementation of applications and services before, after, or during their release into the production environment. It can inform software architecture reviews, threat modeling, conversations about secrets management, audit activities and design reviews, among other things.

It’s also useful because it can help you understand where issues might be in individual containers. For example, you can use it to analyze what vulnerabilities (categorized by CVE number) are present on the container by virtue of the software installed.

In a way, it’s similar to getting vulnerability scan results for your containers; however, unlike vulnerability scanning, the container doesn’t need to be “live” to gather this information. So if you have a serialized container (for example stored in a registry or on a developer’s workstation), you still can gain information about what vulnerabilities might impact the software on those containers.

Integrating Into Your Environment

There are, of course, numerous other tools that do similar things — some commercial as well as other open source options. Regardless of whether you are already planning for or evaluating other options to do this, one advantage that an open source option provides (and where Anchore Engine excels) is that you can kick the tires and get started right away.

There are two advantages to this. First, there is immediate security value without the need to wait for a budget cycle or a lengthy integration cycle. It’s an ideal stopgap, even if you ultimately choose to investigate (or go with) another product offering. You can get an idea for the value provided by tools like this, and you can start gathering information immediately.

The second advantage is that it lets you experiment. You actually can experiment with where and how to integrate the data provided by the tool into your release pipelines or operational processes.

Keep in mind that there are numerous options here. You might decide, for example, that you will focus on the left side of the equation and enable developers to examine and evaluate containers themselves — for example, by training them on how to minimize unneeded supporting code, stale libraries, unnecessary packages, or known-vulnerable versions of software.

Alternatively, you might decide that the functionality is most valuable in your CI/CD pipeline, and you might write scripts to automate evaluation as container images make their way through. Lastly, you might decide that you want to gather better information about container images already in production, and use the tool as a way to gather information about what you already have deployed.

Turk outlined how — and why — organizations can get started with usage.

“We believe that deep image inspection should be a best practice for all those who work with containers,” he said. “Anchore Engine is free and open source and can be easily integrated into any CI/CD system. There really is no reason not to scan images before you publish or deploy them, and Anchore Engine comes with an out-of-the-box policy that can raise an alarm for the most commonly encountered vulnerabilities. We recommend that all developers integrate image scanning into their workflow, ideally through one of the many available CI/CD integrations.”

Regardless of where and how you decide to employ it, there is a rapid on-ramp. You can get up and running with five bash commands on a system with connectivity and Docker Compose already installed. No initial dollar investment is necessary to get started. How can you beat that?

How to successfully use containers

Roushan Kumar — Tue, 11 Jun 2019 06:30:08 +0000

Source:- techhq.com

In traditional software development, code developed in one environment doesn’t necessarily run the same when deployed in another; there often are bugs and errors.

Running software in containers in the cloud can help developers overcome many of these issues, and adoption of containerization ecosystems like Docker and Kubernetes continues to grow. In fact, 451 Research predicts that application container technology will grow by 40 percent before 2020. And Gartner predicts that by 2022, more than 75 percent of global organizations will be running containerized apps in production.

Why containers?

Containers are making developers’ lives easier by changing the way software delivery is done.

They hold a great deal of promise, particularly in terms of increasing developer speed and efficiency across hybrid infrastructures. Containers, typically, are a collection of pieces of software and environment that run together as a coherent system. Developers make these systems in the form of container images, test them and make sure they’re acceptable, then deploy them to large environments where the container platform instantiates identical replicas from the image, ensuring it’s the same software running everywhere. The reason that there’s a need for containerization is that it enables repeatable deployments of identical software.

Containers require fewer system resources than hardware or traditional virtual machine (VM) environments because they don’t include operating system images. With VMs, developers may need to buy more hardware because they reach capacity more quickly. Though workloads can certainly be placed in VMs, using containers is a superior approach because it has a better chance of success as cloud computing moves from simple to complex, distributed architectures.

Applications running in containers can be deployed easily to multiple, different container platforms and cloud providers. Containers make software delivery simpler and more predictable because they provide a consistent deployment environment that can be used at all stages of the delivery pipeline. Whether you’re building your software, testing your software or deploying software in production, you can use the same environment to host the software. Containers also can help enterprises modernize legacy applications and create new cloud-native applications that are both scalable and agile.

Containers add value but carry risk

It’s important to understand what containers can and can’t do. For instance, they do eliminate some concerns around how the differences between your development environment and your production environment will affect your application. But containers aren’t totally immune to the types of bug and error concerns that plague traditional software development. The fact that flaws, outages and security incidents still occur is proof that testing tools don’t catch 100 percent of issues.

In fact, a recent report by Snyk found that the top 10 most popular Docker images each contain at least 30 vulnerabilities. On top of that, if you install any container with an older version of an application, there’s a high likelihood that it will contain vulnerabilities.

And that means your organization is still at risk for potential system outages and downtime that can cause significant economic and reputational impact. The Ponemon Institute Cost of a Data Breach Study 2018 found that an hour of disruption can cost a small company US$8,000, a medium company US$74,000, and larger enterprises roughly US$700,000. It’s been a challenge in IT that problems come up with mixed-and-matched software, and that’s what containers solve. However, the issue is that if someone creates an exploit that works against one container, now there will be identical software running everywhere – and it’s going to work against all those containers.

A new approach

Rather than just proceeding with sticking applications in containers and running with them, a new approach is needed when it comes to testing, to help ward off these potential problems.

QA teams need to make sure they test containerized apps under all the circumstances that might be present in production. That’s because containers could behave differently due to variables ranging from system hardware to unexpected network traffic. And by testing in production, bugs are detected before they go live, and threats are isolated before they have an impact.

Increased success, lowered risk

Containers offer many benefits when it comes to software applications and software testing, but they also bring some drawbacks. Containers can be used effectively for their predictability and manageability, but their usage cannot be treated like a silver bullet. It’s important to understand the potential concerns and make sure these are taken into consideration when using them. Their effective use helps you release bug-free, vulnerability-free software that serves customers well and reduces the risk of expensive downtime.

Maritime Containerization Market Outlook Highlights Major Opportunities Likely to Steer Demand During Forecast Period | China Ocean Shipping (Group) Company (COSCO) (China), CMA CGM SA (France), Agility Logistics (Kuwait)

anil — Sat, 08 Jun 2019 06:51:49 +0000

Source:- foxworldmedia.com

The Maritime Containerization analysis is composed of secondary search methods and primary market analysis applications from 2019-2026. Our analysts run telephonic in addition to personal interviews to get the information associated with this Maritime Containerization industry. Additionally, they refer databases of associations in places from the industry, government documents, media releases, financial and annual Maritime Containerization reports, and company sites. We usually Verify Maritime Containerization information or any data from the accounts unless it’s cross-verified with reliable entities.

The global Maritime Containerization market report will be offering information regarding dynamics and covers product and scope summary to specify the terms. That is followed Maritime Containerization investigation closely and with the perspective. The report is composed concerning its Maritime Containerization growth increase speed and volume, revenue, and sales of that truth and attributes.

Get Sample PDF Version of the Report: https://www.researchreportcenter.com/request-sample/1185155

Dominance by Key Players:

China Ocean Shipping (Group) Company (COSCO) (China), CMA CGM SA (France), Agility Logistics (Kuwait), SSA Marine Inc. (USA), Transport Corporation of India Ltd (India), Amerijet International Inc. (US), A.P. Moller-Maersk Group (Denmark), APL Limited (USA), Dubai Ports World Limited (UAE), Mediterranean Shipping Company S.A. (Switzerland), Metro Ports (USA), American Stevedoring Incorporated (USA), China Shipping Container Lines Company Limited (China), Evergreen Marine Corp Ltd (Taiwan), Evergreen Shipping Agency Corp (USA), Exel PLC (US), Gati Ltd (India)

Segmentation by Product–

Ocean Vessel
Cargo Type
Port Management Model

Segmentation by Application–

Oil & Gas
Agriculture
Consummer Goods
Others

Check Discount on this report: https://www.researchreportcenter.com/check-discount/1185155

Segmentation by Region:

North America, China, Rest of Asia-Pacific, UK, Europe, Central & South America, Middle East & Africa

Have a look at a some of the sections of the Maritime Containerization report:

Market Overview: This begins with a Maritime Containerization overview of services and products given in the report and provides sales figures for the years of this forecast period. This section has a synopsis of market segmentation analysis and the regional overview;
Competition by Players by Products, and Application: Since the name suggests this section comprises revenue, and global Maritime Containerization market share analysis;
Regional Evaluation: This component of the Maritime Containerization report brings to elements affecting the growth of economies, and regional markets have been examined based on market share, sales, earnings, and price trends;
Key Figures of this Market: The analysts also have profiled a number of the Maritime Containerization players and believed other facets, price, earnings, product specifications, and markets and also the margin.
Manufacturing Cost Evaluation: This Maritime Containerization section offers labor cost analysis, vital investigation, percentage of cost arrangement, and also costs analysis.
Industrial Chain, Sourcing Strategy, and Buyers: Raw material sourcing and the analysts concentrate on buyers analysis;
Marketing Strategy Analysis, Distributors/Traders: Within this section, the Maritime Containerization analysis provides a vendors and dealers list and elaborates on pricing strategy, plan, market placement, promotion channel growth trends promotion, direct marketing, and marketing stations.
Economy Impact Facets Evaluation: This Maritime Containerization report will be offering SWOT analysis and highlight changes in customer preferences, financial and political environment, and consumer wants.

Docker Database Hacked, 190,000 Users Affected

anil — Fri, 03 May 2019 12:56:45 +0000

Source:- tomshardware.com

Docker, a development platform that allows companies to “build, manage and secure all their applications” and “deploy them anywhere,” announced last week that it discovered a database hack that exposed the information of 190,000 users. The hackers collected usernames, hashed passwords and in some cases GitHub and Bitbucket access tokens used to access repositories on the popular Git platforms many developers use for version control.

Those whose usernames and hashed passwords were hacked got off relatively easy. Usually, it’s not particularly hard to guess at someone’s username–especially if it’s simply their real name–and if Docker properly hashed the passwords they should be difficult to access. (As opposed to some other companies, which leave passwords in plain text readable by literally everyone with a computer.) That’s also a relatively small number of users compared to other hacks.

The people with a real problem are the ones whose GitHub and Bitbucket access tokens were compromised. Those tokens are used to automatically build images of code stored in Git repositories. Bleeping Computer reported that depending on the permissions granted by the token, whoever hacked Docker could use these access tokens to modify the corresponding code repositories. That could enable additional hacks of users of those services. However, Docker said it revoked the stolen access tokens, so those attacks shouldn’t be possible.

The company is asking users to change their passwords–on its site as well as other sites using the same password–and told people whose access tokens were compromised to reconnect their accounts to GitHub or Bitbucket. It also said it’s “enhancing our overall security processes and reviewing our policies” and that “additional monitoring tools are now in place.”

The hack came at an inopportune time. The company announced on April 24 a partnership with Arm to make it easier for developers to deploy “applications for cloud, edge and IoT environments” to systems with processors based on the Arm architecture. It’s also hosting DockerCon, a container industry conference, from April 29 to May 2. But it seems Docker doesn’t want this to detract from those events, as its social media accounts, blog and the news section of its website have all glossed over the database hack.

Instead, Docker disclosed the attack on its Success Center and directly to users who might have been affected. That way, it can let people know what it believes happened while also keeping the focus on its more flattering announcements.

DevOpsSchool.com started one Docker security training program named “Deep Dive into Docker Security” which will be really helpful if you want to be safe in security breaches.

Container-Based Database Platforms: Fueling DevOps

anil — Tue, 02 Oct 2018 04:58:53 +0000

Source- containerjournal.com

Database systems traditionally have relied on rather complex, OS-specific clustering technology to provide high availability. Depending on vendor and configuration, these technologies included shared storage devices, transaction-based replication, storage replication or some combination thereof. In many cases, these configurations required complex storage and network configuration supported by multiple teams at significant cost.

As the use of virtualization became more widespread, virtual machines offered a degree of high availability, and many hypervisors offered some form of disaster recovery provided by storage replication. The database files were contained within a virtual file format, which made it easy and cheaper to implement; however, since the hypervisor was not aware of the transactional state of the database, it meant failing over could return a database in an inconsistent state.

The vast majority of early container deployments were web and application servers. This was for a couple of reasons, the biggest being the challenges of data persistence in an ephemeral container environment. When Google introduced Kubernetes, databases got both consistent storage and namespaces. This provided a couple of major benefits: It introduced high availability into the solution and separated the storage tier from the compute plane. These factors enabled administrators to have a high degree of flexibility in changing the compute resources for the database tier.

Containers offer many benefits over virtual machine deployment, since they run closer to the system and share operating system binaries. The first of these benefits is performance. Compared to a virtual machine, a database container will have better I/O response time. Secondly, containers allow for simplified deployment using their infrastructure as code model and higher density over virtual machine solutions. Also, since all of the containers on a given host share the same base operating system, the amount of patching is reduced.

Another major benefit is the ability to containerize a gold image or use a vendor-supplied image of an RDBMS. While an RDBMS such as MySQL has a very simple installation process, Oracle and SQL Server both require a fairly complex install, patching and post-installation configuration.

While most of the initial support for database containers was in the open source community for relational databases such as Postgres and MySQL and NoSQL solutions such as MongoDB, Redis and others, commercial database vendors including Oracle, Microsoft and IBM have introduced support for both Docker and Kubernetes in recent years. Kubernetes, via its persistent volumes and service configuration, allows for these databases to be highly available and perform actions such as rolling upgrades for RDBMS patches. Separating data and compute also allows for easier DevOps deployment workflows because of fewer moving pieces.

While implementing a new platform such as Kubernetes can be challenging for many enterprises, the “container as a service” offerings in the major public clouds (Amazon, Google and Microsoft) have made it easier to get started. There are still some challenges around maturity, security and integration with existing third-party applications.

Microsoft has made a big investment into SQL Server and the Kubernetes platform, recently introducing SQL Server 2019 at the Ignite conference. This release includes a new group of services called SQL Server Big Data Clusters, which combine a SQL Server database engine with Spark for machine learning and flexible compute and data pools that take advantage of the underlying Kubernetes infrastructure. This kind of commitment to the platform from a major vendor shows both its early maturity and significant future.

It will be several years before the deployment platform of choice for database servers is containers, and the biggest remaining challenge is disaster recovery. While the Kubernetes platform itself is highly available within a given data center, disaster recovery still requires the database platform to supply a mechanism to perform replication. Some platforms already support this, and I would envision more support to come from all the major vendors in the next year. The advantages of containers are very clear both from DevOps deployment scenarios as well as simplified administration, and this will ultimately drive more database workloads in this direction.

How to Make Docker Containers Faster and Improve Performance

anil — Sat, 05 Aug 2017 06:54:30 +0000

Source:- containerjournal.com

Your Docker containers are already fast, at least compared to virtual machines. But what if you want to make them even faster? Here are strategies for optimizing Docker container speed and performance.

If you’re using Docker, it’s probably at least partly because you want your applications to start and run faster. Out of the box, containers offer significant performance advantages over infrastructure built using virtual machines.

Making Containers Even Faster
But why settle for the speed containers give you out of the box? In many cases, there are things you can do to make Docker even faster. They include:

Make your container images lean and mean. When building a container image, include inside the image only what your application needs, and nothing more. For example, if you don’t need an SSH server inside your container, don’t include one. Minimizing the number of components and code inside container images not only helps to keep containers more secure, it also improves performance because resources are not wasted running unnecessary services.

Host Docker on bare metal. Containers that run directly on a bare-metal server, rather than inside a virtual machine, will generally perform better because no system resources are wasted on emulation. To optimize Docker performance, install Docker directly on a bare-metal server—or consider using a system container hypervisor, such as LXD or OpenVZ, and running Docker inside that. System containers give you an abstraction layer between the guest environment and the host without compromising bare-metal performance.

Use a minimalist host operating system. The more services you have running in the operating system that hosts your Docker environment, the fewer system resources are available for running your containerized apps. Using a bare-bones Linux distribution (such as Alpine Linux or RancherOS) for hosting Docker rather than a full-feature system will deliver better performance. Just make sure, of course, that your host system includes the security protections and other necessary features that you need to run Docker.

Use microservices. There are several advantages to migrating your app to microservices. Speed is one of them. Containers that host just a microservice rather than an entire monolithic app will start faster because they have less code to run.

Use a build cache. A build cache can speed the process of building Docker images—albeit with some important caveats that you should understand before using the build cache option.

20 Docker security tools compared

anil — Sat, 05 Aug 2017 06:43:25 +0000

Source:- sysdig.com

There are quite a few Docker security tools in the ecosystem, how do they compare? This is a comprehensive list of Docker security tools that can help you implement some of the container security best practices.

Is Docker insecure? Not at all. Actually features like process isolation with user namespaces, resource encapsulation with cgroups, immutable images and shipping the minimal software and dependencies reduce the attack vector providing a great deal of protection. But, is there anything else we can do? There is much more than image vulnerability scanning and these are 20 container and Docker specific security tools that can help.

Anchore Navigator

Homepage: https://anchore.io/

License: Commercial, some services are free to use.

Use Cases: Pre-production analysis, vulnerability newsfeed.

Anchore Navigator provides a free service for deep inspection of public Docker images. You can also explore their rich repository of dissected public images for full visibility of its content, build process, and discovered CVE threats together with a link with the issue complete description and known fixes.

Using this tool you can perform a deep analysis of your own images and subscribe to the images you frequently use for your deployments to receive security warnings when upgrading to the commercial version.

AppArmor

Homepage: http://wiki.apparmor.net

License: Open Source.

Use Cases: Runtime protection, Mandatory Access Control (MAC).

AppArmor lets the administrator assign a security profile to each program in your system: filesystem access, network capabilities, link and execute rules, etc.

It’s a Mandatory Access Control (or MAC) system, meaning that it will prevent the forbidden action from taking place, although it can also report profile violation attempts.

AppArmor it’s sometimes considered a more accessible and simplified version of SELinux, both are closely related. You only need to learn the profile language syntax and fire your favorite editor to start writing your own AppArmor rules.

Docker context: Docker can automatically generate and load a default AppArmor profile for containers named docker-default. You can create specific security profiles for your containers or the applications inside them.

AquaSec

Homepage: https://www.aquasec.com/

License: Commercial.

Use Cases: Pre-production analysis, runtime protection, compliance & audit, etc.

AquaSec is a commercial security suite designed with containers in mind. Security audit, container image verification, runtime protection, automated policy learning or intrusion prevention capabilities are some of the most relevant features.

AquaSec supports orchestration tools like Docker Swarm, Mesos, Kubernetes or OpenShift. The platform provides programmatic access to its API and can be deployed both locally or in the public cloud.

BlackDuck Docker Security

Homepage:https://www.blackducksoftware.com

License: Commercial.

Use Cases: Pre-production analysis, vulnerability newsfeed, license/legal risks.

Black Duck Hub specializes in container inventory and reporting image inventory, mapping known security vulnerabilities to images indexes and cross project risk reports. You can easily pinpoint the specific libraries, software packages or binaries that are causing the security risk and the assistant will automatically offer you a list of known fixes.

As opposed to similar solutions, Black Duck Hub also analyzes the “License Risk” considering the different software licences that you are currently bundling together to build your containerized distributed system.

Cilium

Homepage: https://www.cilium.io/

License: Open Source.

Use Cases: HTTP-layer network security, network-layer security.

Cilium provides transparent network security between container applications. Based on a new Linux kernel technology called eBPF, allows to define and enforce both network-layer and HTTP-layer security policies based on container/pod identity.

Cilium leverages BPF to perform core data path filtering, mangling, monitoring and redirection. These BPF capabilities are available in any Linux kernel version 4.8.0 or newer.

CoreOS Clair

Homepage:https://coreos.com/clair/docs/latest/

License: Open Source.

Use Cases: Pre-production analysis, vulnerability newsfeed.

Clair is an open source project for the static analysis of vulnerabilities in containers (currently supporting AppC and Docker). Clair periodically refreshes its vulnerability database from a set of configured CVE sources, scrubs the available container images and indexes the installed software packages. If any insecure software is detected, it can alert or block deployment to production.

Since Clair image analysis is static, containers never need to be actually executed, so you can detect a security threat before is already running in your systems. Clair is the security engine used internally for the CoreOS Quay container registry.

Docker capabilities and resource quotas

Homepage: https://www.docker.com

License: Open Source.

Use Cases: Runtime protection, resource DoS protection.

We shouldn’t forget the basic security measures that come already bundled with our OS and the Docker engine.

Resource abuse and denial of service is an often overlooked but very real security problem in a containerized environment with vast amounts of software entities competing for the host resources.

Control Groups (cgroups) is a feature of the Linux kernel that allows you to limit the access processes and containers have to system resources such as CPU, RAM, IOPS and network.

Capabilities allows you to break down the full root permissions into several split permissions, this way you can remove specific capabilities from the root account or augment the capabilities of user accounts at a more granular level.

Docker-bench security

Homepage:https://github.com/docker/docker-bench-security

License: Open Source.

Use Cases: Compliance & audit.

The Docker Bench for Security is a meta-script that checks for dozens of common best-practices around deploying Docker containers in production.

This script is conveniently packaged as a Docker container, just copying and pasting the docker run one-liner from its homepage you can instantly see the results of ~250 checks for your running Docker containers and the host running the Docker engine (Docker CE or Docker Swarm). Docker Bench tests are inspired by the CIS Docker Community Edition Benchmark v1.1.0.

Dockscan

Homepage:https://github.com/kost/dockscan

License: Open Source.

Use Cases: Compliance & audit.

A simple ruby script that analyzes the Docker installation and running containers, both for local and remote hosts.

It’s easy to install and run with just one command and can generate HTML report files. Dockscan reports configured resource limits, containers spawning too many processes or with a high number of modified files, or if your Docker host is allowing containers to directly forward traffic to the host gateway, to name a few checks.

Falco

Homepage: https://www.sysdig.org/falco/

License: Open Source.

Use Cases: Runtime alerting, forensics.

Sysdig Falco is an open source, behavioral monitoring software designed to detect anomalous activity based on the Sysdig monitoring technology. Sysdig Falco works as a intrusion detection system on any Linux host.

Falco is an auditing tool as opposed to enforcement tools like Seccomp or AppArmor. It runs in user space, using a kernel module to intercept system calls, while other similar tools perform system call filtering/monitoring at the kernel level. One of the benefits of a user space implementation is being able to integrate with external systems like Docker, Docker Swarm, Kubernetes, Mesos, etc and import its resources knowledge and tags.

Docker context: Falco supports container-specific context for its rules. Using this tool you can monitor the containers behaviour without instrumenting or modifying them in any way. Custom rule creation is very easy to grasp and the default rules file comes prepopulated with sane defaults.

HashiCorp Vault

Homepage: https://www.vaultproject.io/

License: Free with enterprise version.

Use Cases: Secure container-aware credentials storage, trust management.

Hashicorp’s Vault is an advanced suite for managing secrets: Passwords, SSL/TLS certificates, API keys, access tokens, SSH credentials, etc. It supports time-based secret leases, fine-grained secret access, on-the-fly generation of new secrets, key rolling (renewing keys without losing access to secrets generated using the old one) and much more.

Vaults keeps a detailed audit log to keep track of all the secrets and the access and manipulations performed by each user/entity, so operators can easily trace any suspicious interaction.

Docker context: The secure distribution and traceability of secrets is a core concern in the new microservices and containerized environments, where software entities are constantly spawned and deleted. Vault itself can be deployed as a Docker container.

NeuVector

Homepage: http://neuvector.com/

License: Commercial.

Use Cases: Runtime protection, compliance & audit.

NeuVector focuses on real-time security protection at runtime. Automatically discovers behavior of applications, containers, and services, detects security escalations and other related threats in a similar fashion to other Linux IDS. NeuVector privileged ‘enforcer’ containers are deployed on each physical host, with full access to the local Docker daemon, apart from that, the internal technology used by NeuVector is not thoroughly detailed in the publicly accessible documentation.

NeuVector aims to be a non-intrusive, plug&play security suite, performing automatic discovery of running containers and their default behavior to assist and counsel the operators in the design of their infrastructure security profiles.

Notary

Homepage:https://github.com/docker/notary

License: Open Source

Use Cases: Trusted image repository, trust management and verifiability.

Image forgery and tampering is one major security concern for Docker-based deployments. Notary is a tool for publishing and managing trusted collections of content. You can approve trusted published and create signed collections, in a similar way to the software repository management tools present in modern Linux systems, but for Docker images.

Some of Notary goals include guaranteeing image freshness (most up to date content, to avoid known vulnerabilities), trust delegation between users or trusted distribution over untrusted mirrors or transport channels.

OpenSCAP

Homepage: https://www.open-scap.org/

License: Open Source.

Use Cases: Compliance & audit, certification

OpenSCAP provides a suite of automated audit tools to examine the configuration and known vulnerabilities in your software, following the NIST-certified Security Content Automation Protocol (SCAP).

You can create your own custom assertions and rules and routinely check that any software deployed in your organization strictly abides.

These set of tools is not only focused on the security itself, but also on providing the formal tests and reports that you may need to meet an official security standard.

Docker context: The OpenSCAP suite provides a Docker-specific tool oscap-docker to audit your images, assessing both running containers and cold images.

REMnux

Homepage: https://remnux.org/

License: Open Source.

Use Cases: Forensics.

A security oriented distribution based on Ubuntu. REMnux is a free Linux toolkit for assisting malware analysts with reverse-engineering malicious software, commonly known as forensics. As you can guess, this system bundles a vast amount of pre installed analysis and security tools: Wireshark, ClamAV, tcpextract, Rhino debugger, Sysdig, vivisect… just to name a few.

REMnux aims to be swiss knife that you carry around in a usb memory in case you suspect any of your systems have been compromised.

Docker context: The REMnux project conveniently provides several of its integrated security tools as Docker containers, so you can instantly launch difficult-to-install security applications when you most need them.

SELinux

Homepage: https://selinuxproject.org

License: Open Source.

Use Cases: Runtime protection, Mandatory Access Control (MAC).

Security-Enhanced Linux (SELinux) is a Linux kernel security module. It is often compared with AppArmor, and it’s also a Mandatory Access Control system. SELinux provides security capabilities from mandatory access controls to mandatory integrity controls, role-based access control (RBAC) and type enforcement architecture.

SELinux has a reputation of being particularly complex but powerful, fine-grained and flexible.

Docker context: Similarly to AppArmor, SELinux offers an extra layer of access policies and isolation between the host and the containerized apps.

Seccomp

Homepage: https://www.kernel.org

License: Open Source.

Use Cases: Runtime protection, Mandatory Access Control (MAC).

Seccomp is not so much a tool but rather a sandboxing facility in the Linux kernel. You can think of it as an iptables rules-based firewall but for system calls. It uses Berkeley Packet Filter (BPF) rules to filter syscalls and control how they are handled.

With Seccomp you can selectively choose which syscalls are forbidden/allowed to each container. For example, you can forbid file-permissions manipulations inside your container.

You may have noticed the similarities with Falco, both are closely related to the Linux Syscall API. This articlecompares these two (with AppArmor and SELinux) solutions. TL;DR: Unlike the others, Falco integrates rich high level container specific context to build rules.

Docker context: Docker has used Seccomp since version 1.10 of the Docker Engine, Docker has its own JSON-based DSL that allows you to define profiles that will be compiled to seccomp filters.

Sysdig

Homepage: https://www.sysdig.org/

License: Open source, commercial products built on top of the free technology.

Use Cases: Anomalous behaviour debugging, forensics.

Sysdig is a full-system exploration, troubleshooting and debugging tool for Linux systems. It records all system calls made by any process, allowing system administrators to find bugs in the operating system or any processes running on it.

Sysdig has a command line interface with a syntax similar to tcpdump and a ncurses interface to visually navigate and filter through the events, in a similar fashion to htop or wireshark. The system call capture files allows you to perform forensics on your containers even if they are long gone.

Tenable Flawcheck

Homepage:https://www.tenable.com/flawcheck

License: Commercial.

Use Cases: Pre-production analysis, vulnerability newsfeed.

Tenable, the company perhaps best know for Nessus, the security scanner, acquired Flawcheck, a specific container-focused security solution.

FlawCheck, like other commercial tools in this list, stores container images and scans them as they’re built, before they can reach production. FlawCheck leverages Tenable/Nessus know-how and database of vulnerabilities, malware and intrusion vectors and adapts it to containerized and agile CI/CD environments.

Twistlock

Homepage: https://www.twistlock.com/

License: Commercial.

Use Cases: Pre-production analysis, runtime protection, compliance & audit, etc.

A commercial security suite built to support containerized environments: vulnerability management, access control, analytics and forensics to security standards compliance.

Twistlock integrates with your continuous integration / continuous delivery pipeline, providing native plugins for popular tools like Jenkins or TeamCity and callable webhooks, so you can trigger the indexing and scanning process for every build and testing environment.