Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Container security best practices: Ultimate guide

sysdig.com

Post reply on HN
Print view View original

21–30 of 65 posts

Re: Container security best practices: Ultimate guide

#21

Post by [deleted] »

capableweb wrote: post #7
simonebrunozzi wrote: post #4

Earlier quoted context omitted.

(disclaimer: I know the company and some of the early founders) I wish all "marketing documents" were this detailed. In other words, I disagree with you. I've read the blog post and it doesn't seem too high level. The resources you indicate are nice, but a 60-pages kubernetes hardening guide by the US Government is perhaps one level deeper than a blog post on internet.

Clearly sounds like a marketing document. Cites a survey from "Cloud Native Computing Foundation" and claims "92 percent of companies are using containers in production" + "Thus, Kubernetes, Openshift, and other container technologies are present everywhere" while ignoring the fact that the survey is heavily biased towards companies that run containers, of course. Their own services and blog posts is also referenced…

[deleted]

Re: Container security best practices: Ultimate guide

#22

Post by eatonphil »

The thing that kills me about all of this is how hard it is to do it right. I wish there were a dumbed down version of containers and orchestrators for people trying to do basic multi-tenant compute in a SaaS and don't care a ton about the best performance.

Would I be generally ok if I use gvisor to give a shell environment to customers and just keep the host up to date?

Or is using containers just relatively pointless for multitenant compute in a SaaS compared to giving customers virtual machines?

If you can't imagine the kind of SaaS I'm talking about, think something along the lines of Github's new online IDE, CodeSpaces.

Re: Container security best practices: Ultimate guide

#23

Post by 0xbadcafebee »

OrvalWintermute wrote: post #3

Unfortunately, this reads like a 100 foot marketing document for Sysdig, not actual container security best practices. If you want to look at actual container security best practices, check out CIS [1] & DISA [2], and NSA [3], with some theory at NIST [4], as well as the documentation from your preferred cloud vendors, be it AWS, Azure, GCP, or other, as well as the specific container security practices. [1] https://…

Even if it is a marketing document, it's still got incredibly valuable information. Almost nobody is going to read a government specification, but they will probably read this page.

Re: Container security best practices: Ultimate guide

#24

Post by raesene9 »

eatonphil wrote: post #22

The thing that kills me about all of this is how hard it is to do it right. I wish there were a dumbed down version of containers and orchestrators for people trying to do basic multi-tenant compute in a SaaS and don't care a ton about the best performance. Would I be generally ok if I use gvisor to give a shell environment to customers and just keep the host up to date? Or is using containers just relatively pointle…

Multi-Tenant Kubernetes is straight up difficult to do well, especially where you're talking hard multi-tenancy for external customers.

There was a good report that covered a lot of the risks and mitigations here https://raw.githubusercontent.com/salesforce/kubernetes-cont...

But even then that had limited scope and didn't cover things like networking.

Re: Container security best practices: Ultimate guide

#25

Post by blowski »

ziddoap wrote: post #14
moochmooch wrote: post #13

Earlier quoted context omitted.

It's funny that you use the term "actual" to describe the guidance from the US government. They don't really know what they are talking about. Their release process for guidance takes so long that by the time it's release, it's out of date. This is absolutely true for k8s guidance. Last I checked, they were suggesting everyone use "Docker Enterprise" on their guidance long after it no longer existed (are vendors supp…

I always have to laugh a little bit when someone says NIST, NSA, etc. just "don't really know what they are talking about". They aren't perfect (you know, being humans and all), and can sometimes be slow in disseminating information to the public, but you're out to lunch if you think they "don't really know" anything.

Yeah. Typical dev hyperbole.

In a similar vein, a fairly mid-level dev was recently trying to convince me that "Rob Pike is a clueless idiot who knows nothing about language design".

Re: Container security best practices: Ultimate guide

#26

Post by OrvalWintermute »

raesene9 wrote: post #18
danjc wrote: post #5

Curious to know whether anyone here can speak to how much safer Hyper V isolation[1] is than process isolation and whether it negates some of the concerns in the article. 1. https://docs.microsoft.com/en-us/virtualization/windowsconta...

Microsoft's guidance (last I looked) was that Windows containers (e.g. the non Hyper-V ones) were not a security boundary, only Hyper-V based Windows containers should be considered to provide isolation. That has the slight clash with the fact that Hyper-V containers are not currently supported under Kubernetes ( https://kubernetes.io/docs/setup/production-environment/wind... ):) For more depth on the challenges of s…

To add to above:

Virtualization & Containerization security depends a great deal on the security of the underlying platform.

Hyper-V can be used on endpoints [1], similar to VMware Workstation.

It can also be installed as a role on top of Windows Server [2], and, used as bootable OS of its own[3] (likely deprecated in the future, so no hyper-v server past server 2019).

Related to this is the type of Windows server install, as it touches on attack surface also [4], but I believe there are constraints for the very small installs.

This matters because attack surface is likely to be, from smallest to largest: hyper-v server [1] https://docs.microsoft.com/en-us/virtualization/hyper-v-on-w...

[2] https://docs.microsoft.com/en-us/windows-server/virtualizati...

[3] https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-...

[4] https://docs.microsoft.com/en-us/previous-versions/windows/d...

Re: Container security best practices: Ultimate guide

#27

Post by y4mi »

blowski wrote: post #25
ziddoap wrote: post #14

Earlier quoted context omitted.

I always have to laugh a little bit when someone says NIST, NSA, etc. just "don't really know what they are talking about". They aren't perfect (you know, being humans and all), and can sometimes be slow in disseminating information to the public, but you're out to lunch if you think they "don't really know" anything.

Yeah. Typical dev hyperbole. In a similar vein, a fairly mid-level dev was recently trying to convince me that "Rob Pike is a clueless idiot who knows nothing about language design".

I somehow think that their opinion was a little more nuanced then that.

And fwiw, Rob Pike definitely did make mistakes. Golang is a great language, but it's not perfect.

Re: Container security best practices: Ultimate guide

#28

Post by simonebrunozzi »

capableweb wrote: post #7
simonebrunozzi wrote: post #4

Earlier quoted context omitted.

(disclaimer: I know the company and some of the early founders) I wish all "marketing documents" were this detailed. In other words, I disagree with you. I've read the blog post and it doesn't seem too high level. The resources you indicate are nice, but a 60-pages kubernetes hardening guide by the US Government is perhaps one level deeper than a blog post on internet.

Clearly sounds like a marketing document. Cites a survey from "Cloud Native Computing Foundation" and claims "92 percent of companies are using containers in production" + "Thus, Kubernetes, Openshift, and other container technologies are present everywhere" while ignoring the fact that the survey is heavily biased towards companies that run containers, of course. Their own services and blog posts is also referenced…

In this sense, yes, I agree with you. But a "100 foot marketing document" offers a certain negative connotation that reads like "no content, just fluff"; the content is there, and yes, it is biased, and yes, no competitors are mentioned.

I also agree with you on the fact that a "smarter" kind of content marketing would go beyond these limitations; it would mention competitors, or alternatives; and it wouldn't highlight its company's own services too much.

If someone from Sysdig is reading, these are suggestions for you, guys.

Re: Container security best practices: Ultimate guide

#29

Post by travisd »

raesene9 wrote: post #19
dpedu wrote: post #2

Perhaps I overlooked it, but it seems strange there's nothing about making containers immutable and read-only. This is a powerful tool IMO. https://cloud.google.com/architecture/best-practices-for-ope...

Yep I've always had read only root filesystems down as a good control and one that's often not too tough to implement. Another favourite of mine would be using multi-stage builds and minimal base images in production (FROM Scratch, where possible). having limited or no tooling in the running container makes an attackers life trickier for sure.

The distroless static images are pretty good. It’s essentially scratch plus certificate authority roots of trust.

Re: Container security best practices: Ultimate guide

#30

Post by simonebrunozzi »

eatonphil wrote: post #22

The thing that kills me about all of this is how hard it is to do it right. I wish there were a dumbed down version of containers and orchestrators for people trying to do basic multi-tenant compute in a SaaS and don't care a ton about the best performance. Would I be generally ok if I use gvisor to give a shell environment to customers and just keep the host up to date? Or is using containers just relatively pointle…

Reinventing the wheel, all the time. Early VMware (with VMs) had a much better sense of product than Google had with K8S.
Post reply on HN