Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Auto-Cascading Security Updates Through Docker Images
Similar to Auto-Cascading Security Updates Through Docker Images (20)
Recently uploaded
Recently uploaded (20)
Auto-Cascading Security Updates Through Docker Images
- 1. ANDREY FALKO - SEPTEMBER 2018 Auto-Cascading SecurityUpdates ThroughDocker Images
- 2. Agenda • The Problem • Solution • Live Demo • Challenges • Conclusion
- 3. TheProblem
- 4. Security Researcher Vulnerability Code Change Public Disclosure Distribution Package OS Base Image Python Base Image Java Base Image Node Base Image Application Image Application Image Application Image Application Image
- 5. Security Researcher Vulnerability Code Change Public Disclosure Distribution Package OS Base Image Python Base Image Java Base Image Node Base Image Application Image Application Image Application Image Application Image MANUAL
- 6. The Problem Order Matters OS Base Image Java Base Image Application Image
- 7. The Problem Order Matters OS Base Image Java Base Image Application Image
- 8. The Problem Order Matters OS Base Image Java Base Image Application Image
- 9. The Problem Race Against Time Vulnerabilities disclosed on a daily basis The longer you take to update, the longer you are vulnerable
- 10. The Problem Cost Why not rebuild continuously?
- 11. Solution
- 13. Developer reviews and merges
- 14. Dockerfile Image Update Command line tool developed at Salesforce Designed to be invoked by Jenkins Open sourced! https://goo.gl/VQXBXk
- 15. Dockerfile Image Update Scans GitHub for all images that use the parent image Parent Image: The image name you have just built Version: The version of the image Persistance Repo: GitHub repository that contains mapping of image names to desired version # dockerfile-image-update parent <parent image> <version> <persistance repo>
- 16. Dockerfile Image Update Example usage # dockerfile-image-update parent centos_jdk 10 image-tag-store
- 17. Dockerfile Image Update What is in image-tag-store? { "images": { "centos": "7.2-123", "centos_jdk": "10" } }
- 18. Dockerfile Image Update When do we use it? For every image in image-tag-store: Recreate pull requests for images not on intended versions Run at specific time cadence # dockerfile-image-update all image-tag-store
- 20. LiveDemo
- 21. LiveDemo • https://jenkins.afalko.net/jenkins • Demo script - Scan shows images all have vulnerability caused by base OS - Pull request made to fix base image - Pull request merged and children updated - Vulnerability fixed for all images!
- 22. Challenges
- 23. Control Over Build What if you don’t control CI for parent? FROM ubuntu:latest
- 24. Image Versioning What if you don’t control image versioning?
- 25. Intermediate Repository Remap external image to internal FROM ubuntu:latest FROM internal-registry/ubuntu:ca6254c
- 26. Time-based Builds Build at a set cadence
- 27. Detect Updated Tags Track image digests LATEST 2f9d158
- 28. Unmerged Pull Requests What if your service owners don’t merge the PRs?
- 29. Conclusion
- 30. Takeaways Automate routine security patching Test before merge Take extra steps with public images
- 31. Further Improvements Users and Contributors Welcome! https://goo.gl/VQXBXk Feature wishlist Auto-merge support Maven Spotify plugin support Update docker-compose and Kubernetes pod.yaml Expand to other packaging types Auto-detect changes of image tags Bitbucket and Gitlab support
- 32. Acknowledgements Thank you! Min Ho Park: Salesforce intern that wrote initial version of dockerfile-image-update Engineers who helped on design, fixes, features, and production support at Salesforce: Justin Harringa Nelson Wolf Jinesh Doshi Lyft productivity team who built and designed similar tooling at Lyft: Ryan Lane Aneesh Agrawal Brian Witt
- 33. Thank you SEPTEMBER 2018 https://goo.gl/VQXBXk Andrey Falko <afalko@lyft.com>