Blue Whale in an Enterprise Pond
•Download as PPTX, PDF•
2 likes•437 views
- Tero Niemistö discusses using Docker in the Finnish public sector, where there are many regulatory requirements around data security, privacy, and infrastructure. This results in obstacles to building Docker solutions. - He outlines some of the key requirements around auditing, server compliance, data residency, personnel clearances, and more. He then provides examples of processes for securely building, deploying, and managing containers within this regulated environment. - Key aspects of their approach include building secure containers, automating compliance checks, duplicating systems across secure server rooms, and scanning for vulnerabilities at every stage of the development process.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (7)
Similar to Blue Whale in an Enterprise Pond
Similar to Blue Whale in an Enterprise Pond (20)
More from Digia Plc
More from Digia Plc (7)
Recently uploaded
Recently uploaded (20)
Blue Whale in an Enterprise Pond
- 1. Blue Whale in an Enterprise Pond – Docker experiences from the real world (in Finland) Tero Niemistö
- 2. Who am I? • Tero Niemistö • Group Manager @Digia • 18 years in the industry, past 6 years in Digia • Cloud/Devops/Docker enthusiast • Father of 3 (1 hairy, 2 hairless) https://www.linkedin.com/in/teroniemisto https://twitter.com/tero_niemisto
- 3. DOCKER HUB Your Typical Docker Architecture
- 4. DOCKER HUB …with Finnish ICT Requirements…
- 5. DOCKER HUB …results in this!
- 7. VAHTI Treasury Order 54 Finnish Communications Regulatory Authority KATAKRI Ministry of Foreign Affairs Obstacles in building a Docker solution • Authorative requirements to all ICT competitive biddings in Finnish public sector • Auditing tool for Vahti • Often a mandatory requirement • Order gives set of requirements aimed to secure Finnish communications network Reform of EU data protection rules European Union • Privacy by design • Privacy by default
- 8. How do we solve server (or even Docker) compliance to CIS Benchmarks? Solutions often have SLA demands (ie. 99.9%). How can this be quaranteed? Servers need to reside in 2 different data centers (or in same data center but in 2 rooms with different fire compartments) Servers often need to reside in Katakri-audited data centers People who operate servers need to have been cleared by SUPO Data needs to reside in EU or in some cases only in Finland Open source licenses. Do we have any GPL components? Are we using any blacklisted open sourcce components? Cyber Security responsibility in the end, supplier is responsible for all issues related to cyber security (Just) Some issues for consideration
- 9. Checklist with Docker in and Enterprise Pond Build our own secure containers1 Maintain own environment for CI pipeline Double-check security on that the CI pipeline Automate Docker server compliance Duplicate entire system into 2 different server rooms 2 3 4 5 6 Automate container vulnerability scan on every level of the CI pipeline
- 10. Simple Container Creation Process Developer Dockerfile Git Jenkins Sonatype Nexus Creatingcontainers Commit Dockerfile to Git Repository Jenkins detects changes from Git Application container is built according to dockerfile Container file is uploaded to Sonatype Nexus Container stored and served from a private Docker Registery Application container is inspected by Blackduck plugin Define container contents with Dockerfile config
- 11. Slightly More Advanced Creation Process Developer Docker Compose Git Jenkins Sonatype Nexus Creatingcontainers Commit Docker Compose file to Git Repository Jenkins detects changes from Git Application container is built according to docker compose file Container file is uploaded to Sonatype Nexus Container stored and served from a private Docker Registery Application container is inspected by Blackduck plugin Define service connections of the containers Dependencies are retrieved from private registry
- 12. Application Build Process Developer YAML Git Jenkins Sonatype Nexus Creatingapplicationcontainers Commit yaml-file and application code to Git repository Jenkins detects changes from Git Inspect code quality with Sonarqube + Blackduck Application container is built according to yaml configuration file Container file is uploaded to Sonatype Nexus Container stored and served from a private Docker Registery Application container is inspected by Blackduck plugin Create application yaml-file with dependencies Container stored and served from a private Docker Registery Dependencies are retrieved from private registry
- 13. Docker containers Infra level containers (middleware) Application level containers Base level containers Application 1 Alpine Linux Java 8 Ruby Tomcat Ubuntu Python Application 2 Application 3 Served from private repository JBoss MySQL RabbitMQ Jenkins
- 14. Deployment Process Operations Jenkins Kontena Sonatype Nexus Docker Server Deployingapplicationcontainers Kontena Master starts deployment process Kontena retrieves containers from private registry Operations starts deployment process with Jenkins Container is deployed according to strategy and load balancers are updated Kontena deploys container to target runtime environment Jenkins connects to Kontena Master Continuous Compliance To CIS Benchmarks
- 15. Our Typical Docker Architecture
- 16. Our Typical Docker Architecture
- 17. Real Life Issues: Docker Push through proxy • The problem is that docker sends PATCH request with over HTTP but not HTTPS while pushing image. • If nginx (or any) proxy is tuned to redirect any HTTP requests to HTTPS, then docker receives “Method not Allowed” response and push fails • Hint: Configure your proxy to add request header X-Forwarded-Proto DOCKER PUSH (HTTP) HTTPS ”METHOD NOT ALLOWED”
- 18. Real Life Issues: No access to frontend proxy • Often access to customers HTTP internet proxy is very limited or it takes 3 days to change it. • Hint: Even if your system has loadbalancing by service provider, use your own. Makes everything so much easier and you can actually have blue-green setup ”TAKES 3 DAYS…” HAProxy”TAKES 3 SECONDS …”
- 19. Real Life Issues: Attacking with SSH container • We lost access to Docker server due to raising filehandlers too high which crashed ssh process and we couldn’t ssh in anymore • We hijacked the server by deploying SSH container with mount into server’s filesystem. • We then used SED to fix the issue • Hint: Your CI server or local docker orchestration client becomes a new attack vector. Secure it!
- 20. DevOps & CyberSecurity Meetup 14.9. @Digia + We are hiring!
Editor's Notes
- Asiakkaidemme muuttuva digiarki
- Asiakkaamme kertoivat meille, että hyvä ICT-kumppani ymmärtää paljon muutakin kuin vain ohjelmistoja ja laitteita. Käytännön elämää. Ohjelmistomme ja palvelumme ovat merkittävä osa yhteiskuntaa - ne on rakennettu, jotta ihmiset ulottuisivat arjessa pidemmälle ja saisivat jokaisesta päivästä eniten irti. Ohjelmistomme ja palvelumme auttavat asiakastamme ymmärtämään asiakkaitaan, kehittämään heille tuotteita ja palveluja, ohjaamaan toimintaansa sekä hyödyntämään tehokkaasti syntyvää tietoa sekä kytkeä nämä asiat tiiviiseen vuorovaikutukseen.