Source: thenewstack.io
Creating a Trusted Container Supply ChainCategory: Software, Security, Kubernetes, Jenkins, container, github
Cloud Native Computing Foundation and Palo Alto Networks sponsored this post, in anticipation of KubeCon+CloudNativeCon North America 2021 on Oct. 11-15. First, the full stack of the container, from the base image up, must be verified as secure, with acceptable levels of risk for vulnerabilities and configurations. Second, during each phase of the software development life cycle — from development, through the CI/CD pipeline into deployment — there should be consistent feedback and guardrails for violations of those acceptable levels of risk.
If you find that perfect image, running it through a scanner can verify the posture of the image and identify known and unknown malware before you run it in your cluster.
That way, instead of building dependencies on an old release with vulnerabilities, you upgrade first and build on that.
If you find that perfect image, running it through a scanner can verify the posture of the image and identify known and unknown malware before you run it in your cluster.
That way, instead of building dependencies on an old release with vulnerabilities, you upgrade first and build on that.
Related Articles
Community Partners
DevOps Careers