This document discusses Docker security in a DevOps environment. It begins with an introduction to DevOps and Docker containers. It then outlines several Docker security practices, including hardening the Docker host, using TLS with Docker, content trust for images, network segmentation, image vulnerability scanning, and security assessment tools. The document provides an overview of how Docker and containers are used in DevOps and some key strategies for securing Docker deployments.

1. Docker Security in DevOps
environment
Nguyễn Đức Thịnh

2. Xin chân thành cảm ơn các nhà tài trợ

3. Agenda
About me
What is DevOps ?
What is Docker container ?
Docker Security practices

4. About me
- Information Security Engineer
- DevOps Fan

5. Traditional SDLC

6. Angry Dev/Ops
Need release
Need stable
Dev Ops

7. DevOps
Technical benefits:
• Consistent operation delivery
• Continuous Software delivery
• Fast mean-time/recovery
Bussiness benefits:
• Reduced operations costs
• More time availiable to new feature

8. CI/CD Pipeline

9. DevOps Principles
- Centralized source code management and distribution
- Software delivery with suitable system platform
- Build one time, run at anywhere
- Automated as much as possible

10. Docker defines a format for bundling an
application and all its dependencies into a
single object called a container.

11. Docker components

13. Docker container use cases
Application containers:
- Single application
- Follow micro-service design pattern - Short
lifespan
System containers:
- Expose to run as OS service
- Long lifespan
Docker Deamon
Docker Deamon
Nodejs App
Java App
Tomcat
Mysql

14. Dockerfile

15. Docker build –f Dockerfile –t myapp:1.0.0
Docker run –p 1234:8080 myapp:1.0.0
FROM debian:stable
RUN apt-get update && apt-get install -y curl
RUN curl -sL https://deb.nodesource.com/setup | bash -
RUN apt-get install -y nodejs
ADD . /web
RUN cd /web; npm install
EXPOSE 8080
CMD ["node", "/web/index.js"]

16. Containerized Infrastructure

17. Docker Security
practices

18. Docker host hardening
●Use Container OS : CoreOS, PhotonOS, RancherOS..
●Configure Docker with
■--icc=false
■--log-level=“info”
■--iptables=true
■--disable-legacy-registry=false

19. ExecStart=/usr/bin/dockerd --icc=false --log-level=”info” --iptables=true --default-ulimit nproc=1024:2408 --default-ulimit
nofile=1024:2048 --disable-legacy-registry=false sudo systemctl daemon-reload sudo service docker restart

20. Using the TLS with Docker
[Service]
Environment="DOCKER_OPTS=-H=0.0.0.0:2376 -H unix:///var/run/docker.sock --tlsverify -
tlscacert=/etc/docker/ssl/ca.pem --tlscert=/etc/docker/ssl/cert.pem --tlskey=/etc/docker/ssl/key.pem"

21. Docker Trusted Content
●CIS 1.13 BENCHMARK : SECTION 4.5
●Content Trust is the cryptographic guarantee that the image pulled is the correct
image.
●export DOCKER_CONTENT_TRUST=1

22. Nano-Segmentation Networking

23. Docker Image Vulnerable Scanning

24. Docker security assessment tools
Tool Test Area
docker-bench-security Docker Host
OpenSCAP Docker Images + Docker Container
Clair Docker Images + Docker Container
Twistlock
Docker Images
Docker Container
Packages
Aqua Security Docker Images + Docker Container + Packages

25. Q&A