Production sec ops with kubernetes in docker
•
1 like•418 views
In this talk, Scott Coulton will walk through how to build a container as a service platform with Docker EE. Starting from scratch he will help you figure out what orchestrator to choose by deep diving into the technical differences between swarm and kubernetes on the EE platform as well as cover some of the practical considerations that could influence your decision. He will also share various automation solutions to deploy your cluster into production. Once the cluster is up and and running, Scott will delve into sec ops and discuss security best practices - including signing images in DTR (Docker Trusted Registry) and CVE scanning to provide a secure supply chain into production. You’ll leave this talk with the knowledge needed to build your own container platform in production. And did I mention it will all be done live, step-by-step?
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Production sec ops with kubernetes in docker
Similar to Production sec ops with kubernetes in docker (20)
More from Docker, Inc.
More from Docker, Inc. (20)
Recently uploaded
Recently uploaded (13)
Production sec ops with kubernetes in docker
- 1. Scott Coulton Principal software engineer, Puppet Production SecOps With Kubernetes In Docker
- 3. v Let’s build a CaaS What's the difference (Swarm vs Kubernetes) Now for the fun stuff secops with Kubernetes Agenda
- 4. Let’s build a CaaS
- 6. So let's look at the platform architecture
- 7. Operating Systems Platform Architecture Config Mgt Monitoring LoggingCI/CD ..more..Images Networking Volumes PhysicalVirtualizationPublic Cloud Platform Security Developer Services Registry Services Access Policies App Lifecycle Management Automation & Extensibility Networking Orchestration Storage Container Engine ENTERPRISE EDITION PLATFORM
- 8. Docker EE Architecture Docker EE Cluster Node Node Node DOCKER ENTERPRISE EDITION Node Manager Worker Node Worker Worker Worker Node Manager Node Manager Management Plane
- 9. Docker EE Orchestration Secure Cluster Management App Scheduler Swarm KubernetesOR Docker EE Cluster Node Node Node
- 10. What’s the difference ?
- 11. ● Uses docker cli ● Deploys applications through ‘stacks’ ● Overlay networking Swarm
- 12. ● kubectl as the cli tool ● More deployment definitions ie pods, svc, deployments ● Plug and play networking with CNI Kubernetes
- 13. In Docker EE you can swap and change
- 14. Live demo time
- 15. Now for the fun stuff secops with Kubernetes
- 17. https://www.fortinet.com/blog/threat-research/yet-another- crypto-mining-botnet.html https://github.com/docker/hub-feedback/issues/1121 This attack allowed the hackers to gain access to your Docker host via a vulnerable image. Hackers going to hack
- 18. Hackers going to hack
- 19. How do we protect from this threat ?
- 21. Secure Supply Chain TEST STAGING • Signature verification • Native encryption Scanning SigningAutomated PoliciesDocker for Mac or Docker for Windows PRODUCTION
- 23. Production Environments Docker Trusted Registry Docker UCP Production Environments Version Control Docker UCP Non-Production EnvironmentsDeveloper Machine Development CI/CD Operations Datacenter 1 Datacenter 2 Docker Trusted Registry Docker for Secure Supply Chain
- 24. CI Workflow Docker Trusted Registry Build container $ git clone $ mvn deploy Repository Manager binaries Version Control src Dockerfiles docker-compose.yml files pull push CI Agent $ docker run -it --rm builder build runs build start CI Agent $ git clone $ docker build -t myapp $ docker push myapp push pull CI Agent $ eval $(<env.sh) $ docker run $ docker service $ docker-compose up Docker UCP Test Environment CI Agent $ eval $(<env.sh) $ docker run -it --rm test uat $ docker pull myapp $ docker push myapp test pull 1 2 3 4runs app runs tests
- 25. Notary client config for DockerHub ~/.notary/config.json { "trust_dir" : "~/.docker/trust", "remote_server": { "url": "https://notary.docker.io" } }
- 26. Notary client config for your registry ~/.notary/config.json { "trust_dir" : "~/.docker/trust", "remote_server": { "url": "dtr_url", "root-ca": "dtr_ca.pem" } }
- 27. Push and sign your application $ export DOCKER_CONTENT_TRUST=1 $ docker push {dtr_url/registry_url}/{account}/{repository}:{tag}
- 28. The one take away from this talk “Sign your images” Scott Coulton Principal software engineer Puppet
- 30. Run as non root apiVersion: v1 kind: Pod metadata: name: my-dockercon-app spec: securityContext: runAsUser: 1000
- 31. Read only file system apiVersion: v1 kind: Pod metadata: name: my-dockercon-app spec: securityContext: readOnlyRootFilesystem: true
- 32. Privilege escalation apiVersion: v1 kind: Pod metadata: name: my-dockercon-app spec: securityContext: allowPrivilegeEscalation: false
- 33. You don't have to chose one apiVersion: v1 kind: Pod metadata: name: my-dockercon-app spec: securityContext: runAsUser: 1000 readOnlyRootFilesystem: true allowPrivilegeEscalation: false
- 35. A great blog post on this stuff https://blog.jessfraz.com/post/containers-security-and-echo-chambers/
- 36. Apparmor apiVersion: v1 kind: Pod metadata: name: my-dockercon-app annotations: container.apparmor.security.beta.kubernetes.io/dockercon: runtime/default spec: containers: - name: dockercon
- 37. Selinux apiVersion: v1 kind: Pod metadata: name: my-dockercon-app spec: securityContext: seLinuxOptions: level: "s0:c123,c456" containers: - name: dockercon
- 38. v Questions
- 39. v Thank you !