Docker, Kubernetes, Rancher… just a few of the container technologies out there. The buzz around containers is still growing, as they can make a seismic impact on release velocity. But what’s the best way to add containers to your technology stack? Get the low down from a container expert who will separate the facts from fiction. What’s the best path to scale your adoption and usage? How do you guard against user privilege escalation? How do containers fit into a DevOps approach? In this talk, Liz Rice will: -Explain what’s involved in the lifecycle stages: Develop, Registry, and Deploy -Build a container live on stage, by writing one in a few lines of Go code -Flag container security risks and give tips on how to achieve peace of mind For more information, visit: www.appdynamics.com

1. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
Containers: Give Me The
Facts, Not The Hype
Liz Rice
@LizRice | @AquaSecTeam

2. 2
What we’ll cover today
■ What are containers?
■ How do containers fit within a DevOps culture?
■ How do you manage containers in production?
@LizRice | @AquaSecTeam

3. What are containers?

4. 4
Many definitions of a container
@LizRice | @AquaSecTeam
■ A “lightweight VM”?
■ Shared environments for
developers?
■ Portable software packaging?
■ Unit of deployment?
■ Unit of scale?
■ Cgroups and namespaces?

5. 5
Bare metal
@LizRice | @AquaSecTeam
server
OS
bins / libs
app A app B

6. 6
Virtual machines
@LizRice | @AquaSecTeam
Hypervisor
server
host OS
bins / libs
app A app B
hypervisor
guest OS
Hypervisorbins / libs
app C app D
guest OS

7. 7
Containers
@LizRice | @AquaSecTeam
server
host OS
bins / libs
app A app B
bins / libs
app C

8. 8
Let’s build one!
@LizRice | @AquaSecTeam

9. Containers & DevOps

10. 10
The emergence of DevOps
@LizRice | @AquaSecTeam

11. 11
Microservices, Containers and DevOps
■ Separation of concerns
■ Small development teams with well-defined responsibilities
■ Continuous integration / continuous deployment
■ Automation
@LizRice | @AquaSecTeam

12. 12
Container Lifecycle: Develop
Base
OS Pre-
reqs
App
Dependencies built into the container
image
@LizRice | @AquaSecTeam

13. 13
Container Lifecycle: Registry
Base
OS Pre-
reqs
App
Public, private or
on-premise registry
@LizRice | @AquaSecTeam

14. 14
Container Lifecycle: Deploy
CPU
Host Operating System
Base
OS Pre-
reqs
App
@LizRice | @AquaSecTeam

15. Containers in production

16. 16
Container advantages
Run
Anywhere
Up in
Seconds
Massive
Scale
@LizRice | @AquaSecTeam

17. 17
■ Automatically run your code somewhere on your machine cluster
■ Replication, availability, scaling
Orchestration
Container Engine Container EngineContainer Engine
Service
discovery

18. 18
Opportunity for better security
■ Prevent unknown images
■ Stop image by CVEs and score
■ Stop user privilege escalation
■ Stop suspicious processes
■ Control capabilities
■ Enforce network isolation
■ Protect the host resources
■ Encrypt sensitive variables
■ Enforce use of automation tools
Container Engine
Production Host
CPU
@LizRice | @AquaSecTeam

19. Summary

20. 20
Dispelling the myths
@LizRice | @AquaSecTeam
Containers aren’t...
■ magic
■ virtual machines
■ insecure

21. 21
Containers are...
@LizRice | @AquaSecTeam
■ Lightweight, high-speed virtualization
■ Shared environments for developers
■ Portable software packaging
■ Unit of deployment
■ Unit of security
■ Unit of scale
■ … ready for production!

22. 22
Find out more
@LizRice | @AquaSecTeam
■ Worldwide community
■ Meetups
■ Conferences
■ Slack channels
■ Online tutorials
■ katacoda.com
■ Docker Get Started

23. Copyright @ 2017 Aqua Security Software Ltd. All Rights Reserved.
Questions?
Liz Rice
@LizRice | @AquaSecTeam