Topic: Secure Docker Images

[AnalogJ]

• public Docker Images are insecure (show vulns reports)
• alpine
• distroless
• CI/CD integration (snyk/Anchore)
• supply chain attacks -
• investigate https://www.open-scap.org/
• https://github.com/genuinetools/bane
• https://github.com/dev-sec/cis-docker-benchmark
• https://github.com/quay/clair
• https://github.com/google/docker-explorer
• https://github.com/docker/docker-bench-security
• https://github.com/aquasecurity/trivy
• https://github.com/sigstore/cosign

[AnalogJ]

• https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
• https://brianchristner.io/how-to-use-docker-scan/
• https://snyk.io/blog/10-docker-image-security-best-practices/
• http://crunchtools.com/comparison-linux-container-images/