Hah, yeah, the ops teams definitely have a handle on what's supposed to be running in those containers. I bet they love the idea of being able to just whitelist the approved processes and block everything else.
Yeah, and Docker's runtime analysis capabilities can really help automate the process of building that whitelist. It can monitor the container and suggest the minimum set of processes that need to be allowed.
Absolutely, that's a great point. The Dockerfile is where developers specify the processes that should be run in the container, so it's a natural place to define the whitelist. Anything outside of that is likely to be malicious or unwanted.
This question is really getting at the heart of why containers are so well-suited for a whitelist-based security approach. The key is that containers typically have a very small, defined set of processes that should be running - unlike a traditional server or VM which can have all sorts of random processes.
upvoted 0 times
...
Log in to Pass4Success
Sign in:
Report Comment
Is the comment made by USERNAME spam or abusive?
Commenting
In order to participate in the comments you need to be logged-in.
You can sign-up or
login
Tamra
6 months agoCecily
6 months agoLuther
6 months agoLorrie
6 months agoMelissa
6 months agoJolene
6 months agoRebeca
6 months agoAlisha
6 months ago