Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Docker Container Security: Hardening Images, Runtime, and Delivery

bugbunny.ai | blog | #supply-chain | #cloud-security | #devsecops | #container-security | #secrets-management | #docker | #runtime-security | #registry | #image-hardening

Summary

Docker container security beyond images: pin minimal base images, run as non-root with dropped capabilities and read-only filesystems, keep secrets out of build contexts, and gate registry pushes.
Published
Collected

original ↗

Related coverage

blog · aikido.dev
Cloud Container Security: Protecting Kubernetes and Beyond
Unlike VMs, containers share the host kernel, so isolation alone isn't enough. The guide breaks down four layers—image, registry, runtime, and orchestrator—with practical steps to secure each.
blog · jfrog.com
JFrog4JFrog: DevSecOps Made Simple
Developers simply want to write code without interruption, while operations wish to build as fast as possible and deploy without restrictions. On the other hand, security professionals want to protect every step of the software supply chain from any potential security threats and vulnerabilities. In software development, every piece of code can potentially introduce vulnerabilities…
blog · wiz.io
Unveiling eBPF: Harnessing Its Power to Solve Real-World Issues
Part two of Wiz's eBPF series: kernel-level observability answers real security questions—container escape attempts, RCE via non-standard sockets, /etc/shadow access—to harden Kubernetes workloads.
blog · wiz.io
Docker and Kubernetes, we have got you covered: Wiz simplifies compliance and security posture management for Docker and Kubernetes environments.
Wiz extends its CIS SecureSuite Vendor Certification to CIS Kubernetes v1.7 and Docker 1.6 benchmarks (Levels 1 and 2), bringing 100+ controls for compliance and secure configuration.
blog · netspi.com
Attacking Azure Container Registries with Compromised Credentials
Stolen Azure Container Registry admin credentials enable Docker login, image and tag enumeration via Registry REST APIs, and pulling containers to hunt secrets; MicroBurst's Get-AzACR automates it.
blog · netspi.com
2013 Cyber Threat Forecast Released
Reviews the Georgia Tech 2013 cyber threat forecast: cloud botnets, mobile browser and wallet flaws, malware obfuscation, counterfeit hardware in the supply chain, and healthcare data risks.
back