SlideShare a Scribd company logo
Containing the cloud
Wes Widner
@kai5263499
Containers
represent
complexity
● Every piece is
important
● Notes help us
manage complexity
● Expect every
component involved
to show their work
Docker
Registry
K8S
Master
etcd
K8S Worker
K8S Worker
K8S Worker
Pod
Container
Pod
Container
Data plane
Designed for
developers
Everyone loves having
the playground to
themselves
● Dockerfiles help
eliminate
snowflakes
● “Containers don’t
contain” - Daniel
Walsh RedHat
My friend said “Suggest to President
Obama that the team should deploy to
production every day.”
-Bill Higgins
healthcare.gov tech surge
Developers and
ops need
different images
● Templated Dockerfiles to
share structure
● Multi-stage builds to share
data
● Debug images for developers
● Separate repos for everyone
Where do images
come from?
● Production images should
come from CI/CD pipelines
● Repos in registries
should be segregated
● Everything should be
logged
What’s in your
prod layers?
● Layer construction is open
for inspection
● Add forensics information to
LABELs
● Seperate services by
function
● Understand that the kernel
is your attack surface
● Lint like crazy
Continuous image
scanning
● It’s easy to bake unwanted
things into images
● What’s clean today may not be
clean tomorrow
● We need a way to
retroactively scan images
● It’s also useful to just know
what an image contains at
build time
What happens
when the cloud
breaks?
● Let forensics be your
guide to a secure cloud
● Pretend the cloud has
melted down and put
everything in place
that you would want to
have
Misconfiguration
is the root of
all evil
● By definition, you
don’t mean to do it
● This is an even bigger
problem with
declarative systems
● How long does it take
for you to detect a
misconfiguration?
Configuration as
code
● Even without formal code
reviews, version
controlled configurations
are useful
● One-off configuration
updates are not only bad
form, they’re an incident
waiting to happen
Try not to let
people break
assumptions
● Allowing containers to
change means they will
● Mutable containers make
forensics needlessly hard
Least privileged
workers
● Privilege separation is hard
● There is not an official standard
for container security policies
● Workers can be tainted to run
sensitive pods
● Another option is multiple clusters
● Workers don’t need operational
secrets
Monitoring your
orchestrator
● Kubernetes security
solutions fall into three
broad categories
● Admin API control
● eBPF for tagging packets
and syscalls
● Hypervisor shims
● Runner-up category for
auditd
A little chaos
is good for you
● Chaos engines are not only
good for development.
They’re also good for
security
● They help smoke out false
assumptions
● Cloud fuzzing is a thing
How mature is your cloud?
❏ Properly configured access
controls to registries and
API servers
❏ Tagged packets from pods,
continuous image scanning
❏ Execution logs
❏ Images developed and pushed
from a build system
❏ Version controlled
Dockerfiles, configs, and
config values
What’s your Okta?
https://github.com/kai5263499/
container-security-awesome
More resources
● Write everything down
● Trust but verify
● Kick the tires
● Pyramid of truth
Roadmap

More Related Content

What's hot

Making your app soar without a container manifest
Making your app soar without a container manifestMaking your app soar without a container manifest
Making your app soar without a container manifest
LibbySchulze
 
E bpf and profilers
E bpf and profilersE bpf and profilers
E bpf and profilers
LibbySchulze
 
Secure GitOps pipelines for Kubernetes with Snyk & Weaveworks
Secure GitOps pipelines for Kubernetes with Snyk & WeaveworksSecure GitOps pipelines for Kubernetes with Snyk & Weaveworks
Secure GitOps pipelines for Kubernetes with Snyk & Weaveworks
Weaveworks
 
Introduction to DevOps
Introduction to DevOpsIntroduction to DevOps
Introduction to DevOps
Deepu S Nath
 
Chris Homer - Moving the entire stack to k8s within a year – lessons learned
Chris Homer - Moving the entire stack to k8s within a year – lessons learnedChris Homer - Moving the entire stack to k8s within a year – lessons learned
Chris Homer - Moving the entire stack to k8s within a year – lessons learned
Dariia Seimova
 
DevOps
DevOpsDevOps
DevOps
RavneetArora
 
OSMC 2017 | How is Zabbix doing – an outside look by Rihards Olups
OSMC 2017 | How is Zabbix doing – an outside look by Rihards OlupsOSMC 2017 | How is Zabbix doing – an outside look by Rihards Olups
OSMC 2017 | How is Zabbix doing – an outside look by Rihards Olups
NETWAYS
 
Introduction to CI/CD
Introduction to CI/CDIntroduction to CI/CD
Introduction to CI/CD
Steve Mactaggart
 
Perforce Helix Git Swarm: Enterprise Git Ecosystem
Perforce Helix Git Swarm: Enterprise Git EcosystemPerforce Helix Git Swarm: Enterprise Git Ecosystem
Perforce Helix Git Swarm: Enterprise Git Ecosystem
Perforce
 
Reactive Amsterdam - Maxim Burgerhout - Quarkus Intro
Reactive Amsterdam - Maxim Burgerhout - Quarkus IntroReactive Amsterdam - Maxim Burgerhout - Quarkus Intro
Reactive Amsterdam - Maxim Burgerhout - Quarkus Intro
Fabio Tiriticco
 
Droisys development process_v_1.1
Droisys development process_v_1.1Droisys development process_v_1.1
Droisys development process_v_1.1
Droisys Inc
 
Webinar: Code Faster on Kubernetes
Webinar: Code Faster on KubernetesWebinar: Code Faster on Kubernetes
Webinar: Code Faster on Kubernetes
Ambassador Labs
 
Introduction to CI/CD
Introduction to CI/CDIntroduction to CI/CD
Introduction to CI/CD
Hoang Le
 
Docker CI at ANZ
Docker CI at ANZDocker CI at ANZ
Docker CI at ANZ
Gede Suparsa
 
Microservices Standardization - Susan Fowler, Stripe
Microservices Standardization - Susan Fowler, StripeMicroservices Standardization - Susan Fowler, Stripe
Microservices Standardization - Susan Fowler, Stripe
Ambassador Labs
 
victoriia basarab - special aspects of dev ops platform development
victoriia basarab - special aspects of dev ops platform developmentvictoriia basarab - special aspects of dev ops platform development
victoriia basarab - special aspects of dev ops platform development
Dariia Seimova
 
Teamcity CI Server
Teamcity CI ServerTeamcity CI Server
Teamcity CI Server
Knoldus Inc.
 
Introduction to Puppet Enterprise 10/03/2018
Introduction to Puppet Enterprise 10/03/2018Introduction to Puppet Enterprise 10/03/2018
Introduction to Puppet Enterprise 10/03/2018
Puppet
 
Why DevOps Tools Do Not Speak Developer Language (and how to overcome this)
Why DevOps Tools Do Not Speak Developer Language (and how to overcome this)Why DevOps Tools Do Not Speak Developer Language (and how to overcome this)
Why DevOps Tools Do Not Speak Developer Language (and how to overcome this)
Komodor
 
Intro to Kubernetes & GitOps Workshop
Intro to Kubernetes & GitOps WorkshopIntro to Kubernetes & GitOps Workshop
Intro to Kubernetes & GitOps Workshop
Weaveworks
 

What's hot (20)

Making your app soar without a container manifest
Making your app soar without a container manifestMaking your app soar without a container manifest
Making your app soar without a container manifest
 
E bpf and profilers
E bpf and profilersE bpf and profilers
E bpf and profilers
 
Secure GitOps pipelines for Kubernetes with Snyk & Weaveworks
Secure GitOps pipelines for Kubernetes with Snyk & WeaveworksSecure GitOps pipelines for Kubernetes with Snyk & Weaveworks
Secure GitOps pipelines for Kubernetes with Snyk & Weaveworks
 
Introduction to DevOps
Introduction to DevOpsIntroduction to DevOps
Introduction to DevOps
 
Chris Homer - Moving the entire stack to k8s within a year – lessons learned
Chris Homer - Moving the entire stack to k8s within a year – lessons learnedChris Homer - Moving the entire stack to k8s within a year – lessons learned
Chris Homer - Moving the entire stack to k8s within a year – lessons learned
 
DevOps
DevOpsDevOps
DevOps
 
OSMC 2017 | How is Zabbix doing – an outside look by Rihards Olups
OSMC 2017 | How is Zabbix doing – an outside look by Rihards OlupsOSMC 2017 | How is Zabbix doing – an outside look by Rihards Olups
OSMC 2017 | How is Zabbix doing – an outside look by Rihards Olups
 
Introduction to CI/CD
Introduction to CI/CDIntroduction to CI/CD
Introduction to CI/CD
 
Perforce Helix Git Swarm: Enterprise Git Ecosystem
Perforce Helix Git Swarm: Enterprise Git EcosystemPerforce Helix Git Swarm: Enterprise Git Ecosystem
Perforce Helix Git Swarm: Enterprise Git Ecosystem
 
Reactive Amsterdam - Maxim Burgerhout - Quarkus Intro
Reactive Amsterdam - Maxim Burgerhout - Quarkus IntroReactive Amsterdam - Maxim Burgerhout - Quarkus Intro
Reactive Amsterdam - Maxim Burgerhout - Quarkus Intro
 
Droisys development process_v_1.1
Droisys development process_v_1.1Droisys development process_v_1.1
Droisys development process_v_1.1
 
Webinar: Code Faster on Kubernetes
Webinar: Code Faster on KubernetesWebinar: Code Faster on Kubernetes
Webinar: Code Faster on Kubernetes
 
Introduction to CI/CD
Introduction to CI/CDIntroduction to CI/CD
Introduction to CI/CD
 
Docker CI at ANZ
Docker CI at ANZDocker CI at ANZ
Docker CI at ANZ
 
Microservices Standardization - Susan Fowler, Stripe
Microservices Standardization - Susan Fowler, StripeMicroservices Standardization - Susan Fowler, Stripe
Microservices Standardization - Susan Fowler, Stripe
 
victoriia basarab - special aspects of dev ops platform development
victoriia basarab - special aspects of dev ops platform developmentvictoriia basarab - special aspects of dev ops platform development
victoriia basarab - special aspects of dev ops platform development
 
Teamcity CI Server
Teamcity CI ServerTeamcity CI Server
Teamcity CI Server
 
Introduction to Puppet Enterprise 10/03/2018
Introduction to Puppet Enterprise 10/03/2018Introduction to Puppet Enterprise 10/03/2018
Introduction to Puppet Enterprise 10/03/2018
 
Why DevOps Tools Do Not Speak Developer Language (and how to overcome this)
Why DevOps Tools Do Not Speak Developer Language (and how to overcome this)Why DevOps Tools Do Not Speak Developer Language (and how to overcome this)
Why DevOps Tools Do Not Speak Developer Language (and how to overcome this)
 
Intro to Kubernetes & GitOps Workshop
Intro to Kubernetes & GitOps WorkshopIntro to Kubernetes & GitOps Workshop
Intro to Kubernetes & GitOps Workshop
 

Similar to Containing the cloud

The journey to Native Cloud Architecture & Microservices, tracing the footste...
The journey to Native Cloud Architecture & Microservices, tracing the footste...The journey to Native Cloud Architecture & Microservices, tracing the footste...
The journey to Native Cloud Architecture & Microservices, tracing the footste...
Mek Srunyu Stittri
 
Introduction to Containers
Introduction to ContainersIntroduction to Containers
Introduction to Containers
Dharmit Shah
 
Moving from Monolith to Microservices
Moving from Monolith to MicroservicesMoving from Monolith to Microservices
Moving from Monolith to Microservices
Mist.io
 
Deploy 22 microservices from scratch in 30 mins with GitOps
Deploy 22 microservices from scratch in 30 mins with GitOpsDeploy 22 microservices from scratch in 30 mins with GitOps
Deploy 22 microservices from scratch in 30 mins with GitOps
Opsta
 
Cloud Native Practice
Cloud Native PracticeCloud Native Practice
Cloud Native Practice
Philip Zheng
 
JOSA TechTalks - Docker in Production
JOSA TechTalks - Docker in ProductionJOSA TechTalks - Docker in Production
JOSA TechTalks - Docker in Production
Jordan Open Source Association
 
An Introduction to Docker
An Introduction to DockerAn Introduction to Docker
An Introduction to Docker
bwinterton
 
Viktor Turskyi "Effective NodeJS Application Development"
Viktor Turskyi "Effective NodeJS Application Development"Viktor Turskyi "Effective NodeJS Application Development"
Viktor Turskyi "Effective NodeJS Application Development"
Fwdays
 
Truemotion Adventures in Containerization
Truemotion Adventures in ContainerizationTruemotion Adventures in Containerization
Truemotion Adventures in Containerization
Ryan Hunter
 
High Available Drupal
High Available DrupalHigh Available Drupal
High Available Drupal
Bram Vogelaar
 
Taking Docker to Production: What You Need to Know and Decide
Taking Docker to Production: What You Need to Know and DecideTaking Docker to Production: What You Need to Know and Decide
Taking Docker to Production: What You Need to Know and Decide
Bret Fisher
 
Taking Docker to Production: What You Need to Know and Decide
Taking Docker to Production: What You Need to Know and DecideTaking Docker to Production: What You Need to Know and Decide
Taking Docker to Production: What You Need to Know and Decide
Docker, Inc.
 
Liferay portals in real projects
Liferay portals  in real projectsLiferay portals  in real projects
Liferay portals in real projects
IBACZ
 
Cloud-Native: A New Ecosystem for Putting Containers into Production
Cloud-Native:  A New Ecosystem for Putting Containers into ProductionCloud-Native:  A New Ecosystem for Putting Containers into Production
Cloud-Native: A New Ecosystem for Putting Containers into Production
Gordon Haff
 
'Effective node.js development' by Viktor Turskyi at OdessaJS'2020
'Effective node.js development' by Viktor Turskyi at OdessaJS'2020'Effective node.js development' by Viktor Turskyi at OdessaJS'2020
'Effective node.js development' by Viktor Turskyi at OdessaJS'2020
OdessaJS Conf
 
Clean architecture
Clean architectureClean architecture
Clean architecture
.NET Crowd
 
Network Automation Journey, A systems engineer NetOps perspective
Network Automation Journey, A systems engineer NetOps perspectiveNetwork Automation Journey, A systems engineer NetOps perspective
Network Automation Journey, A systems engineer NetOps perspective
Walid Shaari
 
Controlled Evolution with Puppet and AWS
Controlled Evolution with Puppet and AWSControlled Evolution with Puppet and AWS
Controlled Evolution with Puppet and AWS
Puppet
 
NetflixOSS Meetup S6E1 - Titus & Containers
NetflixOSS Meetup S6E1 - Titus & ContainersNetflixOSS Meetup S6E1 - Titus & Containers
NetflixOSS Meetup S6E1 - Titus & Containers
aspyker
 
Multiplier Effect: Case Studies in Distributions for Publishers
Multiplier Effect: Case Studies in Distributions for PublishersMultiplier Effect: Case Studies in Distributions for Publishers
Multiplier Effect: Case Studies in Distributions for Publishers
Jon Peck
 

Similar to Containing the cloud (20)

The journey to Native Cloud Architecture & Microservices, tracing the footste...
The journey to Native Cloud Architecture & Microservices, tracing the footste...The journey to Native Cloud Architecture & Microservices, tracing the footste...
The journey to Native Cloud Architecture & Microservices, tracing the footste...
 
Introduction to Containers
Introduction to ContainersIntroduction to Containers
Introduction to Containers
 
Moving from Monolith to Microservices
Moving from Monolith to MicroservicesMoving from Monolith to Microservices
Moving from Monolith to Microservices
 
Deploy 22 microservices from scratch in 30 mins with GitOps
Deploy 22 microservices from scratch in 30 mins with GitOpsDeploy 22 microservices from scratch in 30 mins with GitOps
Deploy 22 microservices from scratch in 30 mins with GitOps
 
Cloud Native Practice
Cloud Native PracticeCloud Native Practice
Cloud Native Practice
 
JOSA TechTalks - Docker in Production
JOSA TechTalks - Docker in ProductionJOSA TechTalks - Docker in Production
JOSA TechTalks - Docker in Production
 
An Introduction to Docker
An Introduction to DockerAn Introduction to Docker
An Introduction to Docker
 
Viktor Turskyi "Effective NodeJS Application Development"
Viktor Turskyi "Effective NodeJS Application Development"Viktor Turskyi "Effective NodeJS Application Development"
Viktor Turskyi "Effective NodeJS Application Development"
 
Truemotion Adventures in Containerization
Truemotion Adventures in ContainerizationTruemotion Adventures in Containerization
Truemotion Adventures in Containerization
 
High Available Drupal
High Available DrupalHigh Available Drupal
High Available Drupal
 
Taking Docker to Production: What You Need to Know and Decide
Taking Docker to Production: What You Need to Know and DecideTaking Docker to Production: What You Need to Know and Decide
Taking Docker to Production: What You Need to Know and Decide
 
Taking Docker to Production: What You Need to Know and Decide
Taking Docker to Production: What You Need to Know and DecideTaking Docker to Production: What You Need to Know and Decide
Taking Docker to Production: What You Need to Know and Decide
 
Liferay portals in real projects
Liferay portals  in real projectsLiferay portals  in real projects
Liferay portals in real projects
 
Cloud-Native: A New Ecosystem for Putting Containers into Production
Cloud-Native:  A New Ecosystem for Putting Containers into ProductionCloud-Native:  A New Ecosystem for Putting Containers into Production
Cloud-Native: A New Ecosystem for Putting Containers into Production
 
'Effective node.js development' by Viktor Turskyi at OdessaJS'2020
'Effective node.js development' by Viktor Turskyi at OdessaJS'2020'Effective node.js development' by Viktor Turskyi at OdessaJS'2020
'Effective node.js development' by Viktor Turskyi at OdessaJS'2020
 
Clean architecture
Clean architectureClean architecture
Clean architecture
 
Network Automation Journey, A systems engineer NetOps perspective
Network Automation Journey, A systems engineer NetOps perspectiveNetwork Automation Journey, A systems engineer NetOps perspective
Network Automation Journey, A systems engineer NetOps perspective
 
Controlled Evolution with Puppet and AWS
Controlled Evolution with Puppet and AWSControlled Evolution with Puppet and AWS
Controlled Evolution with Puppet and AWS
 
NetflixOSS Meetup S6E1 - Titus & Containers
NetflixOSS Meetup S6E1 - Titus & ContainersNetflixOSS Meetup S6E1 - Titus & Containers
NetflixOSS Meetup S6E1 - Titus & Containers
 
Multiplier Effect: Case Studies in Distributions for Publishers
Multiplier Effect: Case Studies in Distributions for PublishersMultiplier Effect: Case Studies in Distributions for Publishers
Multiplier Effect: Case Studies in Distributions for Publishers
 

More from Wes Widner

"make secure" securing the development supply chain All Things Open 2019
"make secure" securing the development supply chain All Things Open 2019"make secure" securing the development supply chain All Things Open 2019
"make secure" securing the development supply chain All Things Open 2019
Wes Widner
 
DIY Jarvis All Things Open 2019
DIY Jarvis All Things Open 2019DIY Jarvis All Things Open 2019
DIY Jarvis All Things Open 2019
Wes Widner
 
Alexa is a snitch - Hacker Halted 2019
Alexa is a snitch  - Hacker Halted 2019Alexa is a snitch  - Hacker Halted 2019
Alexa is a snitch - Hacker Halted 2019
Wes Widner
 
The sound of evil
The sound of evilThe sound of evil
The sound of evil
Wes Widner
 
Homeland security
Homeland securityHomeland security
Homeland security
Wes Widner
 
A worm in the apple
A worm in the appleA worm in the apple
A worm in the apple
Wes Widner
 

More from Wes Widner (6)

"make secure" securing the development supply chain All Things Open 2019
"make secure" securing the development supply chain All Things Open 2019"make secure" securing the development supply chain All Things Open 2019
"make secure" securing the development supply chain All Things Open 2019
 
DIY Jarvis All Things Open 2019
DIY Jarvis All Things Open 2019DIY Jarvis All Things Open 2019
DIY Jarvis All Things Open 2019
 
Alexa is a snitch - Hacker Halted 2019
Alexa is a snitch  - Hacker Halted 2019Alexa is a snitch  - Hacker Halted 2019
Alexa is a snitch - Hacker Halted 2019
 
The sound of evil
The sound of evilThe sound of evil
The sound of evil
 
Homeland security
Homeland securityHomeland security
Homeland security
 
A worm in the apple
A worm in the appleA worm in the apple
A worm in the apple
 

Recently uploaded

APIs for Browser Automation (MoT Meetup 2024)
APIs for Browser Automation (MoT Meetup 2024)APIs for Browser Automation (MoT Meetup 2024)
APIs for Browser Automation (MoT Meetup 2024)
Boni García
 
Energy consumption of Database Management - Florina Jonuzi
Energy consumption of Database Management - Florina JonuziEnergy consumption of Database Management - Florina Jonuzi
Energy consumption of Database Management - Florina Jonuzi
Green Software Development
 
LORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOM
LORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOMLORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOM
LORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOM
lorraineandreiamcidl
 
AI Fusion Buddy Review: Brand New, Groundbreaking Gemini-Powered AI App
AI Fusion Buddy Review: Brand New, Groundbreaking Gemini-Powered AI AppAI Fusion Buddy Review: Brand New, Groundbreaking Gemini-Powered AI App
AI Fusion Buddy Review: Brand New, Groundbreaking Gemini-Powered AI App
Google
 
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptxTop Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
rickgrimesss22
 
Revolutionizing Visual Effects Mastering AI Face Swaps.pdf
Revolutionizing Visual Effects Mastering AI Face Swaps.pdfRevolutionizing Visual Effects Mastering AI Face Swaps.pdf
Revolutionizing Visual Effects Mastering AI Face Swaps.pdf
Undress Baby
 
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Crescat
 
Enterprise Resource Planning System in Telangana
Enterprise Resource Planning System in TelanganaEnterprise Resource Planning System in Telangana
Enterprise Resource Planning System in Telangana
NYGGS Automation Suite
 
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
mz5nrf0n
 
SWEBOK and Education at FUSE Okinawa 2024
SWEBOK and Education at FUSE Okinawa 2024SWEBOK and Education at FUSE Okinawa 2024
SWEBOK and Education at FUSE Okinawa 2024
Hironori Washizaki
 
Utilocate provides Smarter, Better, Faster, Safer Locate Ticket Management
Utilocate provides Smarter, Better, Faster, Safer Locate Ticket ManagementUtilocate provides Smarter, Better, Faster, Safer Locate Ticket Management
Utilocate provides Smarter, Better, Faster, Safer Locate Ticket Management
Utilocate
 
Empowering Growth with Best Software Development Company in Noida - Deuglo
Empowering Growth with Best Software  Development Company in Noida - DeugloEmpowering Growth with Best Software  Development Company in Noida - Deuglo
Empowering Growth with Best Software Development Company in Noida - Deuglo
Deuglo Infosystem Pvt Ltd
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
Safe Software
 
What is Augmented Reality Image Tracking
What is Augmented Reality Image TrackingWhat is Augmented Reality Image Tracking
What is Augmented Reality Image Tracking
pavan998932
 
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Łukasz Chruściel
 
Using Xen Hypervisor for Functional Safety
Using Xen Hypervisor for Functional SafetyUsing Xen Hypervisor for Functional Safety
Using Xen Hypervisor for Functional Safety
Ayan Halder
 
Orion Context Broker introduction 20240604
Orion Context Broker introduction 20240604Orion Context Broker introduction 20240604
Orion Context Broker introduction 20240604
Fermin Galan
 
Fundamentals of Programming and Language Processors
Fundamentals of Programming and Language ProcessorsFundamentals of Programming and Language Processors
Fundamentals of Programming and Language Processors
Rakesh Kumar R
 
Transform Your Communication with Cloud-Based IVR Solutions
Transform Your Communication with Cloud-Based IVR SolutionsTransform Your Communication with Cloud-Based IVR Solutions
Transform Your Communication with Cloud-Based IVR Solutions
TheSMSPoint
 
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdfAutomated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
timtebeek1
 

Recently uploaded (20)

APIs for Browser Automation (MoT Meetup 2024)
APIs for Browser Automation (MoT Meetup 2024)APIs for Browser Automation (MoT Meetup 2024)
APIs for Browser Automation (MoT Meetup 2024)
 
Energy consumption of Database Management - Florina Jonuzi
Energy consumption of Database Management - Florina JonuziEnergy consumption of Database Management - Florina Jonuzi
Energy consumption of Database Management - Florina Jonuzi
 
LORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOM
LORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOMLORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOM
LORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOM
 
AI Fusion Buddy Review: Brand New, Groundbreaking Gemini-Powered AI App
AI Fusion Buddy Review: Brand New, Groundbreaking Gemini-Powered AI AppAI Fusion Buddy Review: Brand New, Groundbreaking Gemini-Powered AI App
AI Fusion Buddy Review: Brand New, Groundbreaking Gemini-Powered AI App
 
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptxTop Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
 
Revolutionizing Visual Effects Mastering AI Face Swaps.pdf
Revolutionizing Visual Effects Mastering AI Face Swaps.pdfRevolutionizing Visual Effects Mastering AI Face Swaps.pdf
Revolutionizing Visual Effects Mastering AI Face Swaps.pdf
 
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
 
Enterprise Resource Planning System in Telangana
Enterprise Resource Planning System in TelanganaEnterprise Resource Planning System in Telangana
Enterprise Resource Planning System in Telangana
 
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
 
SWEBOK and Education at FUSE Okinawa 2024
SWEBOK and Education at FUSE Okinawa 2024SWEBOK and Education at FUSE Okinawa 2024
SWEBOK and Education at FUSE Okinawa 2024
 
Utilocate provides Smarter, Better, Faster, Safer Locate Ticket Management
Utilocate provides Smarter, Better, Faster, Safer Locate Ticket ManagementUtilocate provides Smarter, Better, Faster, Safer Locate Ticket Management
Utilocate provides Smarter, Better, Faster, Safer Locate Ticket Management
 
Empowering Growth with Best Software Development Company in Noida - Deuglo
Empowering Growth with Best Software  Development Company in Noida - DeugloEmpowering Growth with Best Software  Development Company in Noida - Deuglo
Empowering Growth with Best Software Development Company in Noida - Deuglo
 
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FMEEssentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
 
What is Augmented Reality Image Tracking
What is Augmented Reality Image TrackingWhat is Augmented Reality Image Tracking
What is Augmented Reality Image Tracking
 
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
 
Using Xen Hypervisor for Functional Safety
Using Xen Hypervisor for Functional SafetyUsing Xen Hypervisor for Functional Safety
Using Xen Hypervisor for Functional Safety
 
Orion Context Broker introduction 20240604
Orion Context Broker introduction 20240604Orion Context Broker introduction 20240604
Orion Context Broker introduction 20240604
 
Fundamentals of Programming and Language Processors
Fundamentals of Programming and Language ProcessorsFundamentals of Programming and Language Processors
Fundamentals of Programming and Language Processors
 
Transform Your Communication with Cloud-Based IVR Solutions
Transform Your Communication with Cloud-Based IVR SolutionsTransform Your Communication with Cloud-Based IVR Solutions
Transform Your Communication with Cloud-Based IVR Solutions
 
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdfAutomated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
 

Containing the cloud

  • 1. Containing the cloud Wes Widner @kai5263499
  • 2.
  • 3. Containers represent complexity ● Every piece is important ● Notes help us manage complexity ● Expect every component involved to show their work Docker Registry K8S Master etcd K8S Worker K8S Worker K8S Worker Pod Container Pod Container Data plane
  • 4. Designed for developers Everyone loves having the playground to themselves ● Dockerfiles help eliminate snowflakes ● “Containers don’t contain” - Daniel Walsh RedHat
  • 5. My friend said “Suggest to President Obama that the team should deploy to production every day.” -Bill Higgins healthcare.gov tech surge
  • 6. Developers and ops need different images ● Templated Dockerfiles to share structure ● Multi-stage builds to share data ● Debug images for developers ● Separate repos for everyone
  • 7. Where do images come from? ● Production images should come from CI/CD pipelines ● Repos in registries should be segregated ● Everything should be logged
  • 8. What’s in your prod layers? ● Layer construction is open for inspection ● Add forensics information to LABELs ● Seperate services by function ● Understand that the kernel is your attack surface ● Lint like crazy
  • 9. Continuous image scanning ● It’s easy to bake unwanted things into images ● What’s clean today may not be clean tomorrow ● We need a way to retroactively scan images ● It’s also useful to just know what an image contains at build time
  • 10. What happens when the cloud breaks? ● Let forensics be your guide to a secure cloud ● Pretend the cloud has melted down and put everything in place that you would want to have
  • 11.
  • 12. Misconfiguration is the root of all evil ● By definition, you don’t mean to do it ● This is an even bigger problem with declarative systems ● How long does it take for you to detect a misconfiguration?
  • 13. Configuration as code ● Even without formal code reviews, version controlled configurations are useful ● One-off configuration updates are not only bad form, they’re an incident waiting to happen
  • 14. Try not to let people break assumptions ● Allowing containers to change means they will ● Mutable containers make forensics needlessly hard
  • 15. Least privileged workers ● Privilege separation is hard ● There is not an official standard for container security policies ● Workers can be tainted to run sensitive pods ● Another option is multiple clusters ● Workers don’t need operational secrets
  • 16. Monitoring your orchestrator ● Kubernetes security solutions fall into three broad categories ● Admin API control ● eBPF for tagging packets and syscalls ● Hypervisor shims ● Runner-up category for auditd
  • 17. A little chaos is good for you ● Chaos engines are not only good for development. They’re also good for security ● They help smoke out false assumptions ● Cloud fuzzing is a thing
  • 18. How mature is your cloud? ❏ Properly configured access controls to registries and API servers ❏ Tagged packets from pods, continuous image scanning ❏ Execution logs ❏ Images developed and pushed from a build system ❏ Version controlled Dockerfiles, configs, and config values What’s your Okta?
  • 20. ● Write everything down ● Trust but verify ● Kick the tires ● Pyramid of truth Roadmap

Editor's Notes

  1. Picture is Cloud Burst by David Taylor
  2. Picture is Misplaced by Joanne Duffy
  3. The small text at the bottom is from my daughter who helped put together these slides