AppSec USA 2014 talk by Chris Swan "Implications & Opportunities at the Bleeding Edge of DevOps"
•Download as PPTX, PDF•
0 likes•800 views
AppSec USA 2014 from Cohesive CTO Chris Swan "Implications & Opportunities at the Bleeding Edge of DevOps" Ever Onward… as DevOps keeps evolving, this session will show you how the newest DevOps patterns and technologies (e.g. Docker) trends continue to change and morph the opportunities and risks for security. It’s more exciting than scary… once you get over the shock
Report
Share
Report
Share
Recommended
Chris Swan ONUG Academy - Container Networks Tutorial
Slides from Chris Swan's ONUG Academy "Hands-On Container Networks" on May 12, 2015
This hands on session will begin by looking at how Docker modifies a Linux host to enable containers to be connected to a network. It will then go through how applications running in containers can be connected together, and the different options for interconnectivity on a host and between hosts. Finally we will take a look at running network application services inside of containers.
Syllabus
Learn what Docker does to your Linux host on installation.
Connect applications running across multiple containers using configuration metadata and compositing tools.
Understand the different Docker networking modes (host, container, none).
Using Pipework to customise network configuration.
Connecting containers across VMs using Open vSwitch.
Using containers for application network services sush as proxies, load balancers and for TLS termination
Learning Objective 1: Understand how containers relate to the host network, and the consequences that has for services running within containers
Learning Objective 2: Understand the different ways that containers can be networked and internetworked.
Learning Objective 3: Use containers to run network application services.
About the topic:
Containers aren’t a new thing, but the Docker project has made them a hot topic as organisations look at new ways to build, ship and run their applications. This brings new challenges for the network as containers are likely to be ten times as numerous as virtual machines. At the same time there is regulatory pressure to move away from the flat LAN model and deliver greater separation and segregation. This presentation will look at how these two forces are coming together, firstly by examining how containers are networked and some of the new approaches and challenges that come with that. This will be followed by a look at how overlay networks are being deployed to achieve ‘microsegmentation’, and ultimately drive a shift towards application centric networking. Of course these forces will collide, bringing us to contained networks of containers.
Chris Swan at Container.Camp: Docker networking
Chris Swan's presentation on Docker Networking from Container.Camp in London 12 September 2014
A look at how stock Docker does networking, and how containers can be connected together. Introduction to libchan and pipework projects, and a look at container internetworking using Open vSwitch and kernel VXLAN. Docker can also be used as a place to run layer 4-7 network application services like SSL termination, proxying, load balancing, content caching and intrusion detection.
Ryan Koop's Docker Chicago Meetup Demo March 12 2014
CohesiveFT's Director of Products & Marketing, Ryan Koop, presented on how CohesiveFT is incorporating Docker containers in our latest version of the virtual networking appliance, VNS3.
Docker Meetup #2 was held on March 12, 2014 at Mediafly
Lopug docker end_of_distro
The document discusses how Docker containers currently reuse existing operating system distributions, which is problematic. It suggests moving away from relying on full operating systems inside containers towards a more minimal model. This would allow for more consistency between what a host system runs versus inside containers. The document outlines several recommendations, including starting containers from scratch rather than existing distributions and being more specific about versions for packages installed.
Docker Security: Are Your Containers Tightly Secured to the Ship?
Docker is hot, Docker security is not? In this talk the risks, benefits and defenses of Docker are discussed. They are followed up by some best practices, which can you use in your daily activities. What is clear is that there is still a lot to do to get your containers secured.
Event: Docker Amsterdam Meetup - January 2015
This presentation was given by Michael Boelen, January 23rd at Schuberg Philis. The event was organized by Mark Robert Coleman with help of Harm Boertien. With a full house of people, Docker security was discussed.
About the author:
Michael Boelen is founder of CISOfy and researches Linux security to build tools and documentation, to simplify it for others. Examples are tools like Rootkit Hunter and Lynis, blog posts and presentations.
Chris Swan at QCon 2014: Using Docker in Cloud Networks
This document discusses Docker, DevOps, and security issues related to containers. It notes that while Dockerfiles are productive for DevOps, containers do not fully contain processes yet. It also points out that images in Docker have a "manifest problem" where it is unclear which exact versions of packages and dependencies were installed. The document encourages keeping track of software versions installed in container images to help address this problem.
Deep Dive in Docker Overlay Networks - Laurent Bernaille - Architect, D2SI
Docker overlay networks allow containers on different hosts to communicate by encapsulating traffic in VXLAN tunnels. The overlay network uses Consul for service discovery and stores network state like MAC address tables. Containers connect to the overlay network via veth interfaces attached to a bridge in the overlay namespace. When a container sends traffic to an unknown destination, the bridge floods it over VXLAN tunnels to other nodes to discover the destination's location.
It takes a Village to do the Impossible - Jeff Lindsay
From one of the most quietly prolific open source developers in the Docker ecosystem comes an exciting new open source tool unlike anything you've seen before. And while that's probably true,it's actually quite mundane in his grand scheme. A two part talk starting with a demo, and then a sampling of what's to come and how you can be a part of it.
Recommended
Chris Swan ONUG Academy - Container Networks Tutorial
Slides from Chris Swan's ONUG Academy "Hands-On Container Networks" on May 12, 2015
This hands on session will begin by looking at how Docker modifies a Linux host to enable containers to be connected to a network. It will then go through how applications running in containers can be connected together, and the different options for interconnectivity on a host and between hosts. Finally we will take a look at running network application services inside of containers.
Syllabus
Learn what Docker does to your Linux host on installation.
Connect applications running across multiple containers using configuration metadata and compositing tools.
Understand the different Docker networking modes (host, container, none).
Using Pipework to customise network configuration.
Connecting containers across VMs using Open vSwitch.
Using containers for application network services sush as proxies, load balancers and for TLS termination
Learning Objective 1: Understand how containers relate to the host network, and the consequences that has for services running within containers
Learning Objective 2: Understand the different ways that containers can be networked and internetworked.
Learning Objective 3: Use containers to run network application services.
About the topic:
Containers aren’t a new thing, but the Docker project has made them a hot topic as organisations look at new ways to build, ship and run their applications. This brings new challenges for the network as containers are likely to be ten times as numerous as virtual machines. At the same time there is regulatory pressure to move away from the flat LAN model and deliver greater separation and segregation. This presentation will look at how these two forces are coming together, firstly by examining how containers are networked and some of the new approaches and challenges that come with that. This will be followed by a look at how overlay networks are being deployed to achieve ‘microsegmentation’, and ultimately drive a shift towards application centric networking. Of course these forces will collide, bringing us to contained networks of containers.
Chris Swan at Container.Camp: Docker networking
Chris Swan's presentation on Docker Networking from Container.Camp in London 12 September 2014
A look at how stock Docker does networking, and how containers can be connected together. Introduction to libchan and pipework projects, and a look at container internetworking using Open vSwitch and kernel VXLAN. Docker can also be used as a place to run layer 4-7 network application services like SSL termination, proxying, load balancing, content caching and intrusion detection.
Ryan Koop's Docker Chicago Meetup Demo March 12 2014
CohesiveFT's Director of Products & Marketing, Ryan Koop, presented on how CohesiveFT is incorporating Docker containers in our latest version of the virtual networking appliance, VNS3.
Docker Meetup #2 was held on March 12, 2014 at Mediafly
Lopug docker end_of_distro
The document discusses how Docker containers currently reuse existing operating system distributions, which is problematic. It suggests moving away from relying on full operating systems inside containers towards a more minimal model. This would allow for more consistency between what a host system runs versus inside containers. The document outlines several recommendations, including starting containers from scratch rather than existing distributions and being more specific about versions for packages installed.
Docker Security: Are Your Containers Tightly Secured to the Ship?
Docker is hot, Docker security is not? In this talk the risks, benefits and defenses of Docker are discussed. They are followed up by some best practices, which can you use in your daily activities. What is clear is that there is still a lot to do to get your containers secured.
Event: Docker Amsterdam Meetup - January 2015
This presentation was given by Michael Boelen, January 23rd at Schuberg Philis. The event was organized by Mark Robert Coleman with help of Harm Boertien. With a full house of people, Docker security was discussed.
About the author:
Michael Boelen is founder of CISOfy and researches Linux security to build tools and documentation, to simplify it for others. Examples are tools like Rootkit Hunter and Lynis, blog posts and presentations.
Chris Swan at QCon 2014: Using Docker in Cloud Networks
This document discusses Docker, DevOps, and security issues related to containers. It notes that while Dockerfiles are productive for DevOps, containers do not fully contain processes yet. It also points out that images in Docker have a "manifest problem" where it is unclear which exact versions of packages and dependencies were installed. The document encourages keeping track of software versions installed in container images to help address this problem.
Deep Dive in Docker Overlay Networks - Laurent Bernaille - Architect, D2SI
Docker overlay networks allow containers on different hosts to communicate by encapsulating traffic in VXLAN tunnels. The overlay network uses Consul for service discovery and stores network state like MAC address tables. Containers connect to the overlay network via veth interfaces attached to a bridge in the overlay namespace. When a container sends traffic to an unknown destination, the bridge floods it over VXLAN tunnels to other nodes to discover the destination's location.
It takes a Village to do the Impossible - Jeff Lindsay
From one of the most quietly prolific open source developers in the Docker ecosystem comes an exciting new open source tool unlike anything you've seen before. And while that's probably true,it's actually quite mundane in his grand scheme. A two part talk starting with a demo, and then a sampling of what's to come and how you can be a part of it.
Docker and kernel security
The document discusses the relative security of containers versus virtual machines. Several experts provide their views:
- Containers are weaker than VMs from a security perspective, according to one source. However, others argue containers can be just as secure as VMs if implemented properly.
- While VMs may be more secure currently, containers are catching up on security, according to a Docker engineer.
- One source argues that no software, including virtualization layers, will be perfectly secure since developers will always write code with security holes.
- For Google, security is the top priority for VMs since they provide stronger isolation than alternative options like containers or bare metal servers.
- Consumer Windows OS lacks
Docker network Present in VietNam DockerDay 2015
The document discusses Docker networking. It begins with an introduction to Docker and why networking is important for communication between containers. It then covers the libnetwork project, Docker networking features in version 1.7 like the docker0 bridge and linking containers, and experimental features like multi-host networking and services. Drivers and plugins for providing networking are described. The document concludes with a call for users to try experimental Docker and contribute to networking projects.
Automatically Renew Certificated In Your Kubernetes Cluster
This slide show you what is cert-manager and what kind of the problem we meet and why we need the cert-manager. also analyze how cert-manager works.
LinuxKit Deep Dive
We open-sourced LinuxKit in April 2017 at DockerCon in Austin. In this session, we'll take a detailed look at some advanced topics of LinuxKit ranging from the general read-only filesystem setup, multi-arch image support for x86_64 and arm64, custom network configuration, and kernel debugging and testing.
Deeper Dive in Docker Overlay Networks
The Docker network overlay driver relies on several technologies: network namespaces, VXLAN, Netlink and a distributed key-value store. This talk will present each of these mechanisms one by one along with their userland tools and show hands-on how they interact together when setting up an overlay to connect containers. The talk will continue with a demo showing how to build your own simple overlay using these technologies. Finally, it will show how we can dynamically distribute IP and MAC information to every hosts in the overlay.
Containerd: Building a Container Supervisor by Michael Crosby
Containerd is a container supervisor that allows users to manage the lifecycle of a container as well as interact with the container while it is executing. Containerd was built to fulfill many of the requirements that we expect from a modern supervisor all while staying small and fast. In this talk, we will discuss some of the design decisions that shaped containerd’s architecture that allows it to reattach to running containers if it was killed and how it is designed to start 100s containers in seconds.
On-Demand Image Resizing from Part of the monolith to Containerized Microserv...
In this talk I will cover our experience moving CNET, from an in-house monolith image resizing application, to a containerized open source micro-service. I will detail the planning and development phases of the micro-service, which utilizes Thumbor. I will also cover the testing, deployment and monitoring strategies used in the process. Running in Docker Swarm Mode and delivering millions of image requests a day, the service has greatly improved stability and reduced infrastructure needs by 80%.
Docker - a lot changed in a year
Docker has developed rapidly in the past year. It started as a simple tool used to package applications into containers using LXC but has since replaced LXC with its own containerization technology. Major releases introduced compatibility with mainstream Linux distributions, a regular release cycle, and production support. The ecosystem around Docker is also expanding rapidly with new tools for container orchestration, composition, and platforms as a service being built using Docker. While Docker has come a long way, there is still work to be done in areas like security and managing container lifecycles and dependencies.
Docker-Hanoi @DKT , Presentation about Docker Ecosystem
The document provides an overview of Docker Platform and Ecosystem. It begins with introductions and background on Docker, explaining how Docker solves the problem of dependency hell and portability issues by allowing applications to run in isolated containers that package code and dependencies. It then discusses key components of Docker including Engine, Registry, Machine, Swarm, Compose and tools like Toolbox and Cloud. The document concludes with examples of using Docker for continuous integration pipelines and microservices architectures.
What’s New in Docker - Victor Vieux, Docker
It’s the first breakout after the keynote and you need to know more about all the latest and greatest Docker announcements. We've got you covered! In this session, Victor Vieux, will go deeper looking into what's new with Docker, demo the latest features and answer your questions.
Perspectives on Docker
This document discusses 10 things not to forget before deploying Docker in production. It covers logging, monitoring, secrets, container access, filesystem choices, disk space usage, build optimizations, download speeds, backups, and Docker clusters. Overall, Docker provides benefits for portability and workflows but has some challenges to address for system-wide deployments in production environments.
Docker: the road ahead
1. The document discusses Docker's roadmap which includes standardizing interfaces for container sandboxing (libcontainer), communication between containers and components (libchan), and orchestrating distributed services (libswarm).
2. It announces libcontainer becoming a standalone project and new contributors joining its development. Libchan is introduced as a lightweight communication protocol and libswarm is presented as a toolkit for composing network services.
3. Identity and authorization are mentioned as upcoming areas of focus, and the document encourages participation in developing these Docker projects.
Leveraging the Power of containerd Events - Evan Hazlett
containerd provides the low-level functionality that enables the Docker Engine to run containers. containerd events provide a simple, yet powerful mechanism to integrate with virtually any other system with minimal effort. This talk will cover what containerd events are and how to use them for integration with systems ranging from monitoring and logging to container networking using CNI (Container Network Interface) plugins.
Head First to Container&Kubernetes
Introduction what is container and how to use it. staring from the comparison to virtual machine and also show how to use the persistent storage and port mapping in containers.
In the last part, shows what is kubernetes and what kind of problems kubernetes want to solve and how it solves.
Introduction to CircleCI
Introduce the key feature of circleci, including the executors/orbs/commands and then demo those cool features.
Troubleshooting Tips from a Docker Support Engineer
The document discusses various troubleshooting techniques for Docker including using tools like socat and curl to characterize networking and TLS issues, checking container processes and permissions, using volumes to store persistent data, and resolving issues with incorrect localhost references between containers. It also provides examples of troubleshooting issues with a Minecraft server, Ruby application, and Nginx proxy configuration.
When Docker Engine 1.12 features unleashes software architecture
This slidedeck deals with new features delivered with Docker Engine 1.12, in a larger context of application architecture & security. It has been presented at Voxxed Days Luxembourg 2016
From Arm to Z: Building, Shipping, and Running a Multi-platform Docker Swarm ...
We live in a multi-platform world, and who doesn't want their project to run on all of them? The last few DockerCon events have covered the introduction of multi-platform image capabilities into the Docker registry and engine releases. Now it's time to put these features to good use building applications across architectures and running them all in a heterogeneous Docker Swarm! In this talk we'll cover the new `docker manifest` command for making multi-architecture images; how to emulate architectures in docker containers on your own machine; and give a live demonstration of these capabilities with a Docker Swarm consisting of workers of different CPU architectures, including armhf, ppc64le, s390x, and x86_64. We'll also share some pointers for making sure your project is multi-platform ready! Three Takeaways: 1. Attendees will be introduced to manifest lists and how to create multi-arch images using the new 'docker manifest' command. 2. Attendees will learn how to easily create and deploy a basic multi-arch service using multi-platform images. 3. Bonus: Attendees will learn how to run non-native docker containers on their systems.
Observability in a Dynamically Scheduled World
The industry is moving toward a microservices architecture, and many companies have embraced container orchestration solutions such as Kubernetes. DigitalOcean is no different. Over the past year, DigitalOcean’s Delivery team has been building a runtime platform based on Kubernetes with the goal of making shipping code easier. The system has empowered service owners to quickly and efficiently deploy and update their applications. A vital component is a white box monitoring and alerting solution based on Prometheus and Alertmanager.
Sneha Inguva offers an overview of the system and shares problems encountered, potential solutions, and key lessons learned in the process. Sneha dives into the setup of Prometheus and Alertmanager that allows service owners to instrument their own metrics and alerts, explaining the service owner’s point of view and the internals that allow for the dynamic addition of alerts, and offers a glimpse of future modifications to the system. Join in to learn how to leverage open source tools for your monitoring and alerting needs.
Docker Networking in OpenStack: What you need to know now
Learn how you bring secure, scalable, available and open software defined networking to Docker containers managed by OpenStack. This session will cover how Docker virtual networks function, how to plumb them into the virtual network fabric and reliably assign information such as IP addresses, virtual interfaces and more. In addition, this session will also cover how to securely wrap Docker containers using security policies and encryption.
Forecast 2014: Software Defined Networking - What's New?
The document discusses software defined networking (SDN) and network function virtualization (NFV). It outlines an agenda covering SDN and NFV, positioning SDN in infrastructure as a service, and 8 usage scenarios for SDNs and NFVs. These include scenarios from version 1 of the SDN usage model as well as new scenarios. The presentation demonstrates proof of concept work and discusses ongoing work with standards bodies and next steps around control path standardization and storage integration.
Deploying Security at Scale
The document summarizes a presentation about deploying security at scale. It discusses the tradeoffs of building security controls into systems versus bolting them on later. It also covers how the Let's Encrypt initiative has made certificates free and easy to consume via APIs. However, the presentation argues that APIs alone are not sufficient for security and events still need to be monitored and addressed. The overall message is that while technologies like APIs and Docker help, more work is still needed in areas like security monitoring, control of metadata, and integrating systems to enable security at scale.
More Related Content
What's hot
Docker and kernel security
The document discusses the relative security of containers versus virtual machines. Several experts provide their views:
- Containers are weaker than VMs from a security perspective, according to one source. However, others argue containers can be just as secure as VMs if implemented properly.
- While VMs may be more secure currently, containers are catching up on security, according to a Docker engineer.
- One source argues that no software, including virtualization layers, will be perfectly secure since developers will always write code with security holes.
- For Google, security is the top priority for VMs since they provide stronger isolation than alternative options like containers or bare metal servers.
- Consumer Windows OS lacks
Docker network Present in VietNam DockerDay 2015
The document discusses Docker networking. It begins with an introduction to Docker and why networking is important for communication between containers. It then covers the libnetwork project, Docker networking features in version 1.7 like the docker0 bridge and linking containers, and experimental features like multi-host networking and services. Drivers and plugins for providing networking are described. The document concludes with a call for users to try experimental Docker and contribute to networking projects.
Automatically Renew Certificated In Your Kubernetes Cluster
This slide show you what is cert-manager and what kind of the problem we meet and why we need the cert-manager. also analyze how cert-manager works.
LinuxKit Deep Dive
We open-sourced LinuxKit in April 2017 at DockerCon in Austin. In this session, we'll take a detailed look at some advanced topics of LinuxKit ranging from the general read-only filesystem setup, multi-arch image support for x86_64 and arm64, custom network configuration, and kernel debugging and testing.
Deeper Dive in Docker Overlay Networks
The Docker network overlay driver relies on several technologies: network namespaces, VXLAN, Netlink and a distributed key-value store. This talk will present each of these mechanisms one by one along with their userland tools and show hands-on how they interact together when setting up an overlay to connect containers. The talk will continue with a demo showing how to build your own simple overlay using these technologies. Finally, it will show how we can dynamically distribute IP and MAC information to every hosts in the overlay.
Containerd: Building a Container Supervisor by Michael Crosby
Containerd is a container supervisor that allows users to manage the lifecycle of a container as well as interact with the container while it is executing. Containerd was built to fulfill many of the requirements that we expect from a modern supervisor all while staying small and fast. In this talk, we will discuss some of the design decisions that shaped containerd’s architecture that allows it to reattach to running containers if it was killed and how it is designed to start 100s containers in seconds.
On-Demand Image Resizing from Part of the monolith to Containerized Microserv...
In this talk I will cover our experience moving CNET, from an in-house monolith image resizing application, to a containerized open source micro-service. I will detail the planning and development phases of the micro-service, which utilizes Thumbor. I will also cover the testing, deployment and monitoring strategies used in the process. Running in Docker Swarm Mode and delivering millions of image requests a day, the service has greatly improved stability and reduced infrastructure needs by 80%.
Docker - a lot changed in a year
Docker has developed rapidly in the past year. It started as a simple tool used to package applications into containers using LXC but has since replaced LXC with its own containerization technology. Major releases introduced compatibility with mainstream Linux distributions, a regular release cycle, and production support. The ecosystem around Docker is also expanding rapidly with new tools for container orchestration, composition, and platforms as a service being built using Docker. While Docker has come a long way, there is still work to be done in areas like security and managing container lifecycles and dependencies.
Docker-Hanoi @DKT , Presentation about Docker Ecosystem
The document provides an overview of Docker Platform and Ecosystem. It begins with introductions and background on Docker, explaining how Docker solves the problem of dependency hell and portability issues by allowing applications to run in isolated containers that package code and dependencies. It then discusses key components of Docker including Engine, Registry, Machine, Swarm, Compose and tools like Toolbox and Cloud. The document concludes with examples of using Docker for continuous integration pipelines and microservices architectures.
What’s New in Docker - Victor Vieux, Docker
It’s the first breakout after the keynote and you need to know more about all the latest and greatest Docker announcements. We've got you covered! In this session, Victor Vieux, will go deeper looking into what's new with Docker, demo the latest features and answer your questions.
Perspectives on Docker
This document discusses 10 things not to forget before deploying Docker in production. It covers logging, monitoring, secrets, container access, filesystem choices, disk space usage, build optimizations, download speeds, backups, and Docker clusters. Overall, Docker provides benefits for portability and workflows but has some challenges to address for system-wide deployments in production environments.
Docker: the road ahead
1. The document discusses Docker's roadmap which includes standardizing interfaces for container sandboxing (libcontainer), communication between containers and components (libchan), and orchestrating distributed services (libswarm).
2. It announces libcontainer becoming a standalone project and new contributors joining its development. Libchan is introduced as a lightweight communication protocol and libswarm is presented as a toolkit for composing network services.
3. Identity and authorization are mentioned as upcoming areas of focus, and the document encourages participation in developing these Docker projects.
Leveraging the Power of containerd Events - Evan Hazlett
containerd provides the low-level functionality that enables the Docker Engine to run containers. containerd events provide a simple, yet powerful mechanism to integrate with virtually any other system with minimal effort. This talk will cover what containerd events are and how to use them for integration with systems ranging from monitoring and logging to container networking using CNI (Container Network Interface) plugins.
Head First to Container&Kubernetes
Introduction what is container and how to use it. staring from the comparison to virtual machine and also show how to use the persistent storage and port mapping in containers.
In the last part, shows what is kubernetes and what kind of problems kubernetes want to solve and how it solves.
Introduction to CircleCI
Introduce the key feature of circleci, including the executors/orbs/commands and then demo those cool features.
Troubleshooting Tips from a Docker Support Engineer
The document discusses various troubleshooting techniques for Docker including using tools like socat and curl to characterize networking and TLS issues, checking container processes and permissions, using volumes to store persistent data, and resolving issues with incorrect localhost references between containers. It also provides examples of troubleshooting issues with a Minecraft server, Ruby application, and Nginx proxy configuration.
When Docker Engine 1.12 features unleashes software architecture
This slidedeck deals with new features delivered with Docker Engine 1.12, in a larger context of application architecture & security. It has been presented at Voxxed Days Luxembourg 2016
From Arm to Z: Building, Shipping, and Running a Multi-platform Docker Swarm ...
We live in a multi-platform world, and who doesn't want their project to run on all of them? The last few DockerCon events have covered the introduction of multi-platform image capabilities into the Docker registry and engine releases. Now it's time to put these features to good use building applications across architectures and running them all in a heterogeneous Docker Swarm! In this talk we'll cover the new `docker manifest` command for making multi-architecture images; how to emulate architectures in docker containers on your own machine; and give a live demonstration of these capabilities with a Docker Swarm consisting of workers of different CPU architectures, including armhf, ppc64le, s390x, and x86_64. We'll also share some pointers for making sure your project is multi-platform ready! Three Takeaways: 1. Attendees will be introduced to manifest lists and how to create multi-arch images using the new 'docker manifest' command. 2. Attendees will learn how to easily create and deploy a basic multi-arch service using multi-platform images. 3. Bonus: Attendees will learn how to run non-native docker containers on their systems.
Observability in a Dynamically Scheduled World
The industry is moving toward a microservices architecture, and many companies have embraced container orchestration solutions such as Kubernetes. DigitalOcean is no different. Over the past year, DigitalOcean’s Delivery team has been building a runtime platform based on Kubernetes with the goal of making shipping code easier. The system has empowered service owners to quickly and efficiently deploy and update their applications. A vital component is a white box monitoring and alerting solution based on Prometheus and Alertmanager.
Sneha Inguva offers an overview of the system and shares problems encountered, potential solutions, and key lessons learned in the process. Sneha dives into the setup of Prometheus and Alertmanager that allows service owners to instrument their own metrics and alerts, explaining the service owner’s point of view and the internals that allow for the dynamic addition of alerts, and offers a glimpse of future modifications to the system. Join in to learn how to leverage open source tools for your monitoring and alerting needs.
Docker Networking in OpenStack: What you need to know now
Learn how you bring secure, scalable, available and open software defined networking to Docker containers managed by OpenStack. This session will cover how Docker virtual networks function, how to plumb them into the virtual network fabric and reliably assign information such as IP addresses, virtual interfaces and more. In addition, this session will also cover how to securely wrap Docker containers using security policies and encryption.
What's hot (20)
Automatically Renew Certificated In Your Kubernetes Cluster
Automatically Renew Certificated In Your Kubernetes Cluster
Containerd: Building a Container Supervisor by Michael Crosby
Containerd: Building a Container Supervisor by Michael Crosby
On-Demand Image Resizing from Part of the monolith to Containerized Microserv...
On-Demand Image Resizing from Part of the monolith to Containerized Microserv...
Docker-Hanoi @DKT , Presentation about Docker Ecosystem
Docker-Hanoi @DKT , Presentation about Docker Ecosystem
Leveraging the Power of containerd Events - Evan Hazlett
Leveraging the Power of containerd Events - Evan Hazlett
Troubleshooting Tips from a Docker Support Engineer
Troubleshooting Tips from a Docker Support Engineer
When Docker Engine 1.12 features unleashes software architecture
When Docker Engine 1.12 features unleashes software architecture
From Arm to Z: Building, Shipping, and Running a Multi-platform Docker Swarm ...
From Arm to Z: Building, Shipping, and Running a Multi-platform Docker Swarm ...
Docker Networking in OpenStack: What you need to know now
Docker Networking in OpenStack: What you need to know now
Viewers also liked
Forecast 2014: Software Defined Networking - What's New?
The document discusses software defined networking (SDN) and network function virtualization (NFV). It outlines an agenda covering SDN and NFV, positioning SDN in infrastructure as a service, and 8 usage scenarios for SDNs and NFVs. These include scenarios from version 1 of the SDN usage model as well as new scenarios. The presentation demonstrates proof of concept work and discusses ongoing work with standards bodies and next steps around control path standardization and storage integration.
Deploying Security at Scale
The document summarizes a presentation about deploying security at scale. It discusses the tradeoffs of building security controls into systems versus bolting them on later. It also covers how the Let's Encrypt initiative has made certificates free and easy to consume via APIs. However, the presentation argues that APIs alone are not sufficient for security and events still need to be monitored and addressed. The overall message is that while technologies like APIs and Docker help, more work is still needed in areas like security monitoring, control of metadata, and integrating systems to enable security at scale.
CloudCamp London 15 Sep 2016 - WebVR
WebVR allows development of virtual reality experiences using only a mobile phone and cardboard viewer. The document demonstrates basic code for rendering 3D objects like spheres, cubes, and cylinders in a VR scene. It also provides an example of replacing the default scene with a dinosaur model running along a 3D track, showing how assets can be imported and interactive elements added.
Security protocols in constrained environments
Security protocols like SSL, TLS, and SSH can be implemented on low-power embedded systems but with some challenges. On low-end 8-bit AVR microcontrollers like those in most Arduinos, security protocols are not feasible due to insufficient SRAM. Mid-to-high-end ARM-based microcontrollers can support security protocols with effort to configure libraries, keys, and cipher suites. Linux-based systems like the Raspberry Pi easily support security protocols using package managers. The main issues are limited memory on low-end systems and needing to handle libraries, keys, and cipher suites for higher-end embedded platforms.
IPexpo - What is DevOps, and why should infrastructure operations care?
DevOps is about changing an organization's culture to prioritize collaboration between development and operations teams through automation and continuous delivery practices. It requires moving beyond simply purchasing new tools and instead focusing on operational design and breaking down silos between teams through culture change. While challenging, DevOps aims to help organizations streamline processes, treat infrastructure as automated and disposable, and deliver value to customers faster through practices like continuous integration and delivery.
Docker Chicago Meetup - July 2014
This document discusses Docker containers and security. It notes that while Dockerfiles are productive for developers and DevOps, containers currently do not fully isolate processes due to limitations of namespaces and capabilities. It also describes a "manifest problem" where the versions of packages installed in an image are not explicitly defined. The document demonstrates how to improve container security using namespaces, capabilities, and mandatory access control and predicts containers will better isolate processes over time with improved techniques and hardware support.
Viewers also liked (6)
Forecast 2014: Software Defined Networking - What's New?
Forecast 2014: Software Defined Networking - What's New?
IPexpo - What is DevOps, and why should infrastructure operations care?
IPexpo - What is DevOps, and why should infrastructure operations care?
Similar to AppSec USA 2014 talk by Chris Swan "Implications & Opportunities at the Bleeding Edge of DevOps"
DevOps for Defenders in the Enterprise
The document discusses how DevOps, security, and information security practices can integrate. It argues that Agile, DevOps, and continuous delivery approaches optimize for delivering value quickly by addressing perceptions of what is probable. Information security has traditionally been separate but can now integrate into the software development pipeline to provide value. Automating security testing and integrating it into build pipelines allows information security to catch up to modern software development practices.
Docker: do's and don'ts
Docker has some issues that make it unsuitable for certain environments:
(1) It has a fast release cycle that introduces breaking changes, making it difficult to maintain infrastructure over years.
(2) Managing a fleet of Docker containers is harder than a single host. Modern infrastructure problems need to be resolved, like sharing permissions between containers and hosts.
(3) While containers provide benefits like isolation and reproducibility, debugging is difficult and monitoring containers is not easy. Security also requires securing multiple Docker components.
Boycott Docker
Docker has several issues that make it unsuitable for managing infrastructure over many years, including frequent breaking changes in new releases, difficulty cleaning up old images, and lack of kernel support. While containers provide benefits like isolation and reproducible environments, monitoring and debugging containers is challenging. Docker also adds security risks compared to traditional infrastructure stacks due to additional layers like registries and daemons.
Dock ir incident response in a containerized, immutable, continually deploy...
This document discusses incident response strategies in a containerized and immutable infrastructure environment like Docker. It addresses challenges like lack of system and software inventory visibility due to rapid container changes, and lack of agent-based security due to single-purpose containers. It proposes solutions like establishing managed base container OSs, whitelisting allowed containers and files, and leveraging logs and sidecar containers to monitor for detections. Response challenges around long investigation timeframes due to short container lifetimes and lack of access are addressed with strategies like comprehensive logging, filesystem artifact preservation, and automating remote response capabilities.
Container Days
This document summarizes a company's journey to implementing Docker containers in production. It begins with using Docker in hackathons and development environments. Early production uses involved deploying individual services as containers but lacked orchestration. They then tried microservices and deploying to a self-hosted registry, which had stability issues. They eventually selected Rancher for orchestration and Quay.io for the registry. Secret configuration is managed using SaltStack pillars. Templating allows a single docker-compose file across environments. Rancher-compose is used to deploy versions to environments and roll back if needed. This overcomes earlier challenges and provides a smooth path to containerized microservices in production.
ContainerDays NYC 2015: "Easing Your Way Into Docker: Lessons From a Journey ...
Slides from Patrick Mizer & Steve Woodruff's talk "Easing Your Way Into Docker: Lessons From a Journey to Production" at ContainerDays NYC 2015: http://dynamicinfradays.org/events/2015-nyc/programme.html#sparefoot
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
In less than two years Docker went from first line of code to major Open Source project with contributions from all the big names in IT. Everyone is excited, but what's in for me - as a Dev or Ops? In short, Docker makes creating Development, Test and even Production environments an order of magnitude simpler, faster and completely portable across both local and cloud infrastructure. We will start from Docker main concepts: how to create a Linux Container from base images, run your application in it, and version your runtimes as you would with source code, and finish with a concrete example.
What DevOps Isn't
This is a presentation I gave to 100+ people at Rev1 Ventures in Columbus, OH. The presentation was about how to define DevOps. Like any new concept, there are multiple and sometimes competing definitions. I've found that implementations of DevOps can change but there are some very common anti-patterns. Lastly, I talk about how we implement DevOps at Bold Penguin.
What's hot docker con eu 2015 & what's new on docker 1.9
DockerCon EU 2015 featured breaking news about Docker's growing ecosystem and security focus. Speakers discussed container as a service (CAAS) platforms like Tutum and the universal control plane for on-premise deployments. Docker 1.9 adds production-ready swarm mode for clustering, improved networking and security features like content trust and image scanning. Demos showed multi-host networking overlays, adding persistent volumes, and namespace locking. Upcoming areas of interest include Microsoft Windows Server 2016 native Docker support and unikernel containers.
codemotion-docker-2014
This document discusses Docker, an open source project that automates the deployment of applications inside software containers. It begins by describing common problems in application deployment and how virtual machines address some issues but introduce overhead. It then summarizes the history and rapid growth of Docker since its launch in 2013. The rest of the document dives into technical aspects of Docker like how images and containers work, comparisons to virtual machines, security considerations, the Docker workflow, and how Docker relates to DevOps and continuous delivery practices.
Common primitives in Docker environments
This document discusses common primitives needed in Docker environments when deploying applications across multiple machines. It outlines several key primitives like persistence, service discovery, monitoring, logging, authentication and authorization. For each primitive, it describes different approaches, lists relevant open source projects, and provides recommendations on how to implement the primitive in a way that is standardized, scalable and works for both new and legacy applications. The goal is to abstract infrastructure and treat all machines similarly while achieving reliability, reproducibility and reducing manual labor.
StackEngine Demo - Docker Austin
StackEngine describes the problems of running containerized applications in production and the solutions it is offering.
Docker, developers take power
How docker change organization of development and ops teams
What is the point for developers when it comes to interactions with underlying system and application dependencies
Lessons learnt by @EnaleanTeam on mytuleap.com experience
Devops : Automate Your Infrastructure with Puppet
"DevOps" denotes a close collaboration and cross-pollination between previous cases i.e, purely the development roles, operations roles and QA roles. As it is necessary for the software to release at an ever-increasing rate, we can see that the old "waterfall" develop-test-release cycle is broken. Devops provides us with consistent software delivery, Faster resolution of complex problems and neatier and crisp feature delivery.
SQL Server in DevOps Town Hall Webinar
SQL Server is container-ready. This deck covers some of the common ideas, misconceptions, myths, and realities of databases like SQL Server in a DevOps model.
PuppetConf 2017: What’s in the Box?!- Leveraging Puppet Enterprise & Docker- ...
“Docker, Docker, Docker.” It’s a phrase we hear often, but what are containers, what can they be used for, and why should you know more about them? In this session, Grace (Puppet) and Tricia (AppDynamics) will introduce attendees to Docker and help them build and deploy their first container with Puppet. They will leverage the docker_image_build module from the Puppet Forge and take attendees through the proper workflow for coupling Docker and Puppet together. The session will focus on how to use some of the newest Docker features, such as multi-stage build files and password stores within Docker so you can pass "secrets" to a swarm for login credentials. The goal is to provide newcomers with a working proficiency of how to get started deploying containers using Puppet as their automation tool.
DockerDay2015: Keynote
This document summarizes a keynote about Docker's goals of making hardware programmable through containers and open standards. The keynote discusses Docker's goals of reinventing the programmer's toolbox by solving problems like runtime, packaging, composition and networking incrementally. It also discusses building better infrastructure plumbing and promoting open standards through projects like runC, Notary, the Open Container Project and more. The goal is to help organizations solve problems in unique ways through an open developer platform and standards.
Docker and SDL Web/Tridion - SDL UK User Group April 2017
Robert Stevenson-Leggett's slides from his talk on using Docker with SDL Tridion/Web in production and some plans for the future.
StackEngine Demo - Boston
StackEngine has talked to over 100 businesses about the direction and needs of companies ranging from start ups still in Stealth mode to the Fortune 100. Combine these learnings with the features currently included in the StackEngine Controller and a solution to production operation begins to come to light.
To think about a production operation we:
* Establish the characteristics of an ideal containerized application.
* Motivate those characteristics in terms of business benefit.
* Discuss the "final mile" problem of taking a containerized service and making it available to the operations team.
* Now that containers are running, how do we inventory what we have and the state that it is in?
* Demo Host, Container and Search pages as a means of inventory management.
* When our monitoring tells us something is wrong on a host, what do we do?
* How do services find each other?
* Discuss how StackEngine will provide service discovery.
* Provide a roadmap overview
Demystifying Containerization Principles for Data Scientists
Demystifying Containerization Principles for Data Scientists - An introductory tutorial on how Dockers can be used as a development environment for data science projects
Similar to AppSec USA 2014 talk by Chris Swan "Implications & Opportunities at the Bleeding Edge of DevOps" (20)
Dock ir incident response in a containerized, immutable, continually deploy...
Dock ir incident response in a containerized, immutable, continually deploy...
ContainerDays NYC 2015: "Easing Your Way Into Docker: Lessons From a Journey ...
ContainerDays NYC 2015: "Easing Your Way Into Docker: Lessons From a Journey ...
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
What's hot docker con eu 2015 & what's new on docker 1.9
What's hot docker con eu 2015 & what's new on docker 1.9
PuppetConf 2017: What’s in the Box?!- Leveraging Puppet Enterprise & Docker- ...
PuppetConf 2017: What’s in the Box?!- Leveraging Puppet Enterprise & Docker- ...
Docker and SDL Web/Tridion - SDL UK User Group April 2017
Docker and SDL Web/Tridion - SDL UK User Group April 2017
Demystifying Containerization Principles for Data Scientists
Demystifying Containerization Principles for Data Scientists
More from Cohesive Networks
CircleCity Con 2017 - Dwight Koop's talk Cybersecurity for real life: Using t...
The document discusses cybersecurity frameworks and introduces the NIST Cybersecurity Framework. It provides an overview of the framework, explaining that it was created to provide a common language for organizations to assess security capabilities, identify gaps, and measure progress across different standards. The framework establishes guidelines for profiling current security levels, setting targets, and developing action plans to close gaps. An example is provided of a company that used the framework to improve security and facilitate auditing and certification.
Chris Purrington's talk from CLOUDSEC 2016 "Defense in depth: practical steps...
Defense in depth: practical steps to securing your data and achieving compliance
Presented by Chris Purrington, the VP Sales Europe at Cohesive Networks
Perimeter-based security approaches have not evolved to meet the modern application-focused enterprise. The weaknesses of the perimeter-based approach are on display in the east/west attacks on Sony, Target, and Home Depot exploits where hackers gained access to the perimeter, then ransacked the internal networks with minimal resistance. What can modern enterprises do? A “defense in depth” approach to security at the network layer. Enterprises must strengthen existing core networking hardware and virtualization layer security with added application security. In data centres, physical network isolation is not practical, and logical segmentation can be very difficult without using evolved networking approaches. As data centers became wholly virtualized and blur the line between data center and private cloud, we can finally add and control logical segmentation at the virtualization layer. This “Application Segmentation” provides the most comprehensive security model available today. You can apply application segmentation defense in depth using Cohesive Networks’ VNS3:turret. VNS3:turret creates a cryptographically unique micro-perimeter around each application topology. This presentation will examine how an defense in depth at the application layer can stop the next Sony attack.
Protecting Vital Data With NIST Framework - Patrick Kerpan's Secure260 presen...
The document discusses the NIST Cybersecurity Framework and risk-based cybersecurity. It provides an overview of the NIST Framework, describing its core components and five tiers of maturity. It also discusses how the Framework establishes a common language and unified process for managing cybersecurity risks across critical infrastructure sectors. Finally, it outlines steps for applying the Framework, including prioritizing risks, assessing cybersecurity programs, and developing action plans to address gaps.
Let’s rethink cloud application security in 2016 - Patrick Kerpan's Secure360...
The document discusses rethinking cloud application security in 2016. It argues that data center security models do not work for cloud security and that applications need security through network virtualization. Upcoming compliance regulations will emphasize network segmentation, application security, and isolation. The document recommends using application layer switches and network controls like micro-perimeters, encrypted overlays and traffic policies to build secure layers of access and control for cloud applications. This will help make 2016 a more secure year.
Lessons Learned in Deploying the ELK Stack (Elasticsearch, Logstash, and Kibana)
Slides from the Chicago AWS user group on May 5th, 2016. Asaf Yigal, Co-Founder and VP Product at Logz.io, presented on using Elasticsearch, Logstash, and Kibana in Amazon Web Services.
"Setting up the increasingly-popular open-source ELK Stack (Elasticsearch, Logstash, and Kibana) on AWS might seem like an easy task, but we have gone through several iterations in our architecture and have made some mistakes in our deployments that have turned out to be common in the industry. In this talk, we will go through what we did and explain what worked and what failed -- and why. We will also provide a complete blueprint of how to set up ELK for production on AWS." ~ @asafyigal
The Chicago School of Cybersecurity: A Pragmatic Look at the NIST Cybersecuri...
By COO & CFO Dwight Koop - Data breaches and cybersecurity costs have brought attention to the dire need for comprehensive, preventative IT security guidelines. Dwight Koop walks through the recent NIST Cybersecurity Framework updates and how it can help businesses in all industry sectors.
Comparison: VNS3 vs Vyatta
VNS3 is a virtual networking platform built for public, private, and hybrid cloud environments that allows users to connect, integrate, and secure cloud-based applications. It enhances network security and has over 2,000 customers in more than 20 countries. VNS3 offers more functionality than competing products like Vyatta and Cisco CSR, including encryption of data in motion, an overlay network, high availability, and the ability to add services through containers.
Comparison: VNS3 and Openswan
Learn more about Cohesive Networks' virtual networking device with our handy comparison guide. See how VNS3 outshines the rest with enhanced capabilities, functionality and interoperability for any public, private or hybrid cloud.
Cohesive Networks Support Docs: VNS3 Administration
Get started with VNS3
Learn how to customize your VNS3 device and network setup. This guide will walk you through how to change your username and passwords, set up VNS3 Firewalls, take VNS3 Snapshots for backup and recovery, Upgrade your VNS3 license, configure other routes in your network, enable SNMP support, and even reset factory defaults.
For additional help, please contact Cohesive Networks Support: https://cohesive.net/support/support-contacts
Cohesive Networks Support Docs: VNS3 Configuration Guide
Get started with VNS3 virtual networking devices.Configure VNS3 for the first time from the web-based UI.
Once you log in to VNS3, you can customize your device and network setup, including:
generate clientpacks, peering VNS3 Controllers in a mesh, IPsec configurations with VNS3 Controllers, IPsec configuration with remove devices, client server connection options, overlay client server configurations, and how to review your VNS3 and overlay network configurations.
For additional help, please contact Cohesive Networks Support: https://cohesive.net/support/support-contacts
Cohesive Networks Support Docs: VNS3 Configuration for AWS EC2 Classic
Use this VNS3 set up guide to get started in the Amazon Cloud (AWS) EC2 public cloud environments. Note: this guide is for AWS customers who are able to launch AMIs outside of VPC (using AWS before 2009)
About VNS3:
VNS3 delivers cloud networking and NFV functionality for virtual and cloud environments. The VNS3 virtual network security appliance includes a router, switch, stateful firewall, VPN support (IPsec and SSL), and protocol redistributor, and extensible NFV optimized for all major cloud providers. VNS3 cloud networks are configured and managed through the VNS3 Manager web-based UI or resetful API.
VNS3 is available in: Amazon Web Services EC2, Amazon Web Services VPC, Microsoft Azure, CenturyLink Cloud, Google Compute Engine (GCE), Rackspace, IBM SoftLayer, ElasticHosts, Verizon Terremark vCloud Express, InterRoute, Abiquo, Openstack, Flexiant, Eucalyptus, Abiquo, HPE Helion, VMware (all formats), Citrix, Xen, KVM, and more.
VNS3 supports most IPsec data center solutions, including: Preferred Most models from Cisco Systems*, Juniper, Watchguard, Dell SONICWALL, Netgear, Fortinet, Barracuda Networks, Check Point*, Zyxel USA, McAfee Retail, Citrix Systems, Hewlett Packard, D-Link, WatchGuard, Palo Alto Networks, OpenSwan, pfSense, Vyatta, and any IPsec device that supports IKE1 or IKE2, AES256 or AES128 or 3DES, SHA1 or MD5, and most importantly NAT-Traversal standards.
Cohesive Networks Support Docs: VNS3 Configuration for Amazon VPC
Use this VNS3 set up guide to get started in the Amazon Cloud (AWS) VPC public cloud environments.
About VNS3:
VNS3 delivers cloud networking and NFV functionality for virtual and cloud environments. The VNS3 virtual network security appliance includes a router, switch, stateful firewall, VPN support (IPsec and SSL), and protocol redistributor, and extensible NFV optimized for all major cloud providers. VNS3 cloud networks are configured and managed through the VNS3 Manager web-based UI or resetful API.
VNS3 is available in: Amazon Web Services EC2, Amazon Web Services VPC, Microsoft Azure, CenturyLink Cloud, Google Compute Engine (GCE), Rackspace, IBM SoftLayer, ElasticHosts, Verizon Terremark vCloud Express, InterRoute, Abiquo, Openstack, Flexiant, Eucalyptus, Abiquo, HPE Helion, VMware (all formats), Citrix, Xen, KVM, and more.
VNS3 supports most IPsec data center solutions, including: Preferred Most models from Cisco Systems*, Juniper, Watchguard, Dell SONICWALL, Netgear, Fortinet, Barracuda Networks, Check Point*, Zyxel USA, McAfee Retail, Citrix Systems, Hewlett Packard, D-Link, WatchGuard, Palo Alto Networks, OpenSwan, pfSense, Vyatta, and any IPsec device that supports IKE1 or IKE2, AES256 or AES128 or 3DES, SHA1 or MD5, and most importantly NAT-Traversal standards.
Cohesive Networks Support Docs: VNS3 Configuration in Azure
Use this VNS3 set up guide to get started in Microsoft Azure public cloud environments.
About VNS3:
VNS3 delivers cloud networking and NFV functionality for virtual and cloud environments. The VNS3 virtual network security appliance includes a router, switch, stateful firewall, VPN support (IPsec and SSL), and protocol redistributor, and extensible NFV optimized for all major cloud providers. VNS3 cloud networks are configured and managed through the VNS3 Manager web-based UI or resetful API.
VNS3 is available in: Amazon Web Services EC2, Amazon Web Services VPC, Microsoft Azure, CenturyLink Cloud, Google Compute Engine (GCE), Rackspace, IBM SoftLayer, ElasticHosts, Verizon Terremark vCloud Express, InterRoute, Abiquo, Openstack, Flexiant, Eucalyptus, Abiquo, HPE Helion, VMware (all formats), Citrix, Xen, KVM, and more.
VNS3 supports most IPsec data center solutions, including: Preferred Most models from Cisco Systems*, Juniper, Watchguard, Dell SONICWALL, Netgear, Fortinet, Barracuda Networks, Check Point*, Zyxel USA, McAfee Retail, Citrix Systems, Hewlett Packard, D-Link, WatchGuard, Palo Alto Networks, OpenSwan, pfSense, Vyatta, and any IPsec device that supports IKE1 or IKE2, AES256 or AES128 or 3DES, SHA1 or MD5, and most importantly NAT-Traversal standards.
Cohesive Networks Support Docs: VNS3 Configuration for CenturyLink Cloud
Use this VNS3 set up guide to get started in CenturyLink Cloud environments.
About VNS3:
VNS3 delivers cloud networking and NFV functionality for virtual and cloud environments. The VNS3 virtual network security appliance includes a router, switch, stateful firewall, VPN support (IPsec and SSL), and protocol redistributor, and extensible NFV optimized for all major cloud providers. VNS3 cloud networks are configured and managed through the VNS3 Manager web-based UI or resetful API.
VNS3 is available in: Amazon Web Services EC2, Amazon Web Services VPC, Microsoft Azure, CenturyLink Cloud, Google Compute Engine (GCE), Rackspace, IBM SoftLayer, ElasticHosts, Verizon Terremark vCloud Express, InterRoute, Abiquo, Openstack, Flexiant, Eucalyptus, Abiquo, HPE Helion, VMware (all formats), Citrix, Xen, KVM, and more.
VNS3 supports most IPsec data center solutions, including: Preferred Most models from Cisco Systems*, Juniper, Watchguard, Dell SONICWALL, Netgear, Fortinet, Barracuda Networks, Check Point*, Zyxel USA, McAfee Retail, Citrix Systems, Hewlett Packard, D-Link, WatchGuard, Palo Alto Networks, OpenSwan, pfSense, Vyatta, and any IPsec device that supports IKE1 or IKE2, AES256 or AES128 or 3DES, SHA1 or MD5, and most importantly NAT-Traversal standards.
Cohesive Networks Support Docs: VNS3 Configuration for IBM Softlayer
The document provides instructions for setting up a VNS3 controller instance on Softlayer. It includes requirements, launching a VNS3 template on Softlayer, configuring public IP access, sizing considerations, and optional configuration of the VNS3 controller as an internet gateway. The steps covered include selecting the VNS3 template, assigning public IP access, launching the instance with appropriate resources, and basic gateway configuration on the VNS3 and Softlayer hosts. Links are also provided to additional VNS3 documentation.
Cohesive Networks Support Docs: VNS3 Configuration for ElasticHosts
Use this VNS3 set up guide to get started in ElasticHosts public cloud environments.
About VNS3:
VNS3 delivers cloud networking and NFV functionality for virtual and cloud environments. The VNS3 virtual network security appliance includes a router, switch, stateful firewall, VPN support (IPsec and SSL), and protocol redistributor, and extensible NFV optimized for all major cloud providers. VNS3 cloud networks are configured and managed through the VNS3 Manager web-based UI or resetful API.
VNS3 is available in: Amazon Web Services EC2, Amazon Web Services VPC, Microsoft Azure, CenturyLink Cloud, Google Compute Engine (GCE), Rackspace, IBM SoftLayer, ElasticHosts, Verizon Terremark vCloud Express, InterRoute, Abiquo, Openstack, Flexiant, Eucalyptus, Abiquo, HPE Helion, VMware (all formats), Citrix, Xen, KVM, and more.
VNS3 supports most IPsec data center solutions, including: Preferred Most models from Cisco Systems*, Juniper, Watchguard, Dell SONICWALL, Netgear, Fortinet, Barracuda Networks, Check Point*, Zyxel USA, McAfee Retail, Citrix Systems, Hewlett Packard, D-Link, WatchGuard, Palo Alto Networks, OpenSwan, pfSense, Vyatta, and any IPsec device that supports IKE1 or IKE2, AES256 or AES128 or 3DES, SHA1 or MD5, and most importantly NAT-Traversal standards.
Cohesive Networks Support Docs: VNS3 Configuration for GCE
Use this VNS3 set up guide to get started in Google Cloud and GCE environments.
About VNS3:
VNS3 delivers cloud networking and NFV functionality for virtual and cloud environments. The VNS3 virtual network security appliance includes a router, switch, stateful firewall, VPN support (IPsec and SSL), and protocol redistributor, and extensible NFV optimized for all major cloud providers. VNS3 cloud networks are configured and managed through the VNS3 Manager web-based UI or resetful API.
VNS3 is available in: Amazon Web Services EC2, Amazon Web Services VPC, Microsoft Azure, CenturyLink Cloud, Google Compute Engine (GCE), Rackspace, IBM SoftLayer, ElasticHosts, Verizon Terremark vCloud Express, InterRoute, Abiquo, Openstack, Flexiant, Eucalyptus, Abiquo, HPE Helion, VMware (all formats), Citrix, Xen, KVM, and more.
VNS3 supports most IPsec data center solutions, including: Preferred Most models from Cisco Systems*, Juniper, Watchguard, Dell SONICWALL, Netgear, Fortinet, Barracuda Networks, Check Point*, Zyxel USA, McAfee Retail, Citrix Systems, Hewlett Packard, D-Link, WatchGuard, Palo Alto Networks, OpenSwan, pfSense, Vyatta, and any IPsec device that supports IKE1 or IKE2, AES256 or AES128 or 3DES, SHA1 or MD5, and most importantly NAT-Traversal standards.
Cohesive Networks Support Docs: Welcome to VNS3 3.5
Welcome to VNS3 version 3.5+
See what's new in the latest public release of VNS3. This guide will walk through the changes to the web-based UI, API, and container plugin system in the new release.
Cohesive Networks Support Docs: VNS3 Side by Side IPsec Tunnel Guide
Create side by side IPsec tunnels using two or more VNS3 Controllers. Use either NAT-Traversal or Native IPsec methods to configure a secure tunnel you control to endpoints you specify in public, private, or hybrid clouds.
Cohesive networks Support Docs: VNS3 3.5 Upgrade Guide
Learn how to upgrade previous versions of VNS3 (or older VPN3 versions) to the latest 3.5.x release.
Follow along with upgrade steps to update, transfer configure settings, and secure your old and new VNS3 devices.
Contact our support team for more information on upgrading to the latest 3.5 version of VNS3.
More from Cohesive Networks (20)
CircleCity Con 2017 - Dwight Koop's talk Cybersecurity for real life: Using t...
CircleCity Con 2017 - Dwight Koop's talk Cybersecurity for real life: Using t...
Chris Purrington's talk from CLOUDSEC 2016 "Defense in depth: practical steps...
Chris Purrington's talk from CLOUDSEC 2016 "Defense in depth: practical steps...
Protecting Vital Data With NIST Framework - Patrick Kerpan's Secure260 presen...
Protecting Vital Data With NIST Framework - Patrick Kerpan's Secure260 presen...
Let’s rethink cloud application security in 2016 - Patrick Kerpan's Secure360...
Let’s rethink cloud application security in 2016 - Patrick Kerpan's Secure360...
Lessons Learned in Deploying the ELK Stack (Elasticsearch, Logstash, and Kibana)
Lessons Learned in Deploying the ELK Stack (Elasticsearch, Logstash, and Kibana)
The Chicago School of Cybersecurity: A Pragmatic Look at the NIST Cybersecuri...
The Chicago School of Cybersecurity: A Pragmatic Look at the NIST Cybersecuri...
Cohesive Networks Support Docs: VNS3 Administration
Cohesive Networks Support Docs: VNS3 Administration
Cohesive Networks Support Docs: VNS3 Configuration Guide
Cohesive Networks Support Docs: VNS3 Configuration Guide
Cohesive Networks Support Docs: VNS3 Configuration for AWS EC2 Classic
Cohesive Networks Support Docs: VNS3 Configuration for AWS EC2 Classic
Cohesive Networks Support Docs: VNS3 Configuration for Amazon VPC
Cohesive Networks Support Docs: VNS3 Configuration for Amazon VPC
Cohesive Networks Support Docs: VNS3 Configuration in Azure
Cohesive Networks Support Docs: VNS3 Configuration in Azure
Cohesive Networks Support Docs: VNS3 Configuration for CenturyLink Cloud
Cohesive Networks Support Docs: VNS3 Configuration for CenturyLink Cloud
Cohesive Networks Support Docs: VNS3 Configuration for IBM Softlayer
Cohesive Networks Support Docs: VNS3 Configuration for IBM Softlayer
Cohesive Networks Support Docs: VNS3 Configuration for ElasticHosts
Cohesive Networks Support Docs: VNS3 Configuration for ElasticHosts
Cohesive Networks Support Docs: VNS3 Configuration for GCE
Cohesive Networks Support Docs: VNS3 Configuration for GCE
Cohesive Networks Support Docs: Welcome to VNS3 3.5
Cohesive Networks Support Docs: Welcome to VNS3 3.5
Cohesive Networks Support Docs: VNS3 Side by Side IPsec Tunnel Guide
Cohesive Networks Support Docs: VNS3 Side by Side IPsec Tunnel Guide
Cohesive networks Support Docs: VNS3 3.5 Upgrade Guide
Cohesive networks Support Docs: VNS3 3.5 Upgrade Guide
AppSec USA 2014 talk by Chris Swan "Implications & Opportunities at the Bleeding Edge of DevOps"
- 1. AppSec USA2014 Denver, Colorado Implications& Opportunities atthe BleedingEdge of DevOps Chris Swan, CTO CohesiveFT @cpswan
- 2. @cpswan CTO – CohesiveFT Cloud native networking Chris Swan – why me? Introduction
- 3. Dockerfile is awesomely productive Great for DevOps Containers don’t contain At least not yet Images have a manifest problem Keep track of your stuff TL;DR
- 4. What do I mean when I say ‘DevOps’? Part 1
- 5. Let’s start with a demo Demo time
- 6. John Boyd’s OODA loop
- 7. Industrialdesign maturity – the auto example Design for purpose Design for manufacture Design for operations
- 8. Industrialdesign maturity - software Design for purpose Design for manufacture Design for operations DevOps is just an artefact
- 10. Containers don’tcontain With thanks to Dan Walsh @rhatdan Watch his DockerCon 2014 presentation at http://is.gd/dcrhdw
- 12. Because containersaren’t VMs And this has yet to come:
- 13. Possibleto have our cake andeat it?
- 14. cgroups
- 15. namespaces mnt mount points, filesystems pid processes net network ipc inter process communication uts hostname device devices user UIDs
- 16. Fine grained control over ‘root’ privileges: • deny all "mount" operations; • deny access to raw sockets (to prevent packet spoofing); • deny access to some filesystem operations, like creating new device nodes, changing the owner of files, or altering attributes (including the immutable flag); • deny module loading; • etc. capabilities
- 17. AppArmor and SELinux MandatoryAccess Control (MAC)
- 18. • Use of namespaces, capabilities and MAC will improve – Might be a game of ‘whack a mole’ • Hard to tell when we’re done (is @solomonstre’s word going to be enough?) • Libcontainer can drive other mechanisms – More secure options might come • Hardware support might come – Existing rings 1 & 2 aren’t used much, but aren’t really suitable – VT-x introduced ring -1, do we need a ring 0.5? <optimist>Containerswillcontain</optimist>
- 20. My Dockerfilefrom (much) earlier
- 21. Eachactive linecreates a layer
- 22. An image binds layers together
- 23. The image is the unit of deployment
- 24. Which versionof Nginxis that?
- 26. Whilst we want this to be cached in the short term: apt-get install nginx We perhaps don’t want it cached in the long term What are those durations? Problem 1 – nondeterminism
- 27. When I run apt-get install nginx I don’t know which version of Nginx I just got Should I? nginx –v > some_log.txt Or maybe? apt-cache policy nginx > some_log.txt Problem 2 – the manifestproblem
- 28. Dockerfile is awesomely productive Great for DevOps Containers don’t contain At least not yet Images have a manifest problem Keep track of your stuff TL;DR
- 29. Questions? Ask now, or on Twitter: @cpswan Questiontime