Container Security and Governance

12/1/2020

This post details the implementation of Binary Authorization in Kubernetes using Google's Grafeas and Kritis, and introduces Voucher as the missing signing service component. Voucher allows for security checks on Docker images before signing them, supporting various checks like verifying image origin and vulnerability levels. It also details how Voucher integrates with build pipelines and metadata services, and its subsequent move into the Grafeas organization as a Google-provided service.

10/12/2017

Introduces the use of Grafeas for storing container metadata and Kritis for enforcing deployment policies on Kubernetes. Details how Grafeas answers auditing questions about containers and how Kritis uses signed attestations from authorities to define and enforce deployment policies, ensuring containers meet security controls like build origin, vulnerability scanning, and rootless execution. Mentions integration with kubeaudit for runtime security checks.

11/18/2014

This post details the creation of Shopify's production Docker base image, advocating for 'thin' containers and the '100 rule' for shared services. It outlines environment setup by transliterating Chef recipes into Dockerfiles, discusses containerizing applications with specific conventions for code layout and Git repos, and emphasizes the 'compile' phase for producing ready-to-run containers. It also touches on debugging techniques and the use of `docker exec`.