8 BEST Docker Security Tools
Containers has helped development and DevOps teams to increase agility and accelerate application development & delivery. But with these benefits there could be loss of visibility and control for teams deploying and managing them. As you’re aware, Containers bundle applications with a lot of software and files that you may not know about or want in your production environment. As container adoption continues to grow, so does the risk of potential open source vulnerabilities hidden inside them and the increasing need for container security.E.g., If any one of the container breaks out,it can allow unauthorized access across containers, hosts or data centers etc., thus affecting all the containers hosted on the Host OS.
A recent study by Forrester Research cited security as the most common barrier to containerization. And as 96% of applications have open source software components, organizations need to take measures to address open source security throughout the entire DevOps process.With this context,now lets checkout BEST Docker Security Tools.
#1. Anchore Cloud
The Anchore Cloud is a free service to let anyone discover and analyze images on public container registries such as DockerHub. User can perform deep inspection and analysis of images including metadata, build data and searchable lists of content including all operating system packages, files and software artifacts such as Ruby GEMs and Node.JS modules.
Key Features :
- Anchore allows users to perform extremely deep container image analysis to see all the operating system packages, Node.JS modules,RubyGEMs, in fact every file in the image is covered in the analysis.
- Detailed security report including Common Vulnerabilities and Exposures (CVEs) can be viewed, allowing the user to see what packages triggered vulnerability alerts and if an update is available.
- Images can be marked as favorites to allow fast access to frequently used images.
#2.AquaSec
Aqua’s cloud-native security platform provides full visibility and control over containerized environments, with tight runtime security controls and intrusion prevention capabilities, at any scale. The platform provides programmatic access to all its functions via an API, for easy integration and automation.
Key Features :
- Scan images for vulnerabilities, secrets, malware and configuration issues
- Prevent unapproved images from running in your environment
- Machine learning of legitimate container behavior, based on application context
- Container-level firewall maps connectivity and prevents network lateral movement
- Securely manages container access to ‘secrets’ across environments
#3.BlackDuck
Black Duck OpsSight helps you prevent known open source vulnerabilities from being deployed into production environments.
Key Features :
- OpsSight works with your container orchestration platform to scan any container image as it is utilized within the cluster and report on any known vulnerabilities by checking against our comprehensive KnowledgeBase.
- OpsSight listens for any changes within your orchestration platform’s event streams.
- Scan results are placed as metadata on the container image so you can display vulnerability risk and enforce policies directly from the console of your container orchestration platform.
- Identify and highlight any images that contain disclosed open source vulnerabilities
- Flag container images that violate open source security policies
- Receive automated alerts when any newly discovered vulnerabilities may affect container images in use within your cluster
#4.Cilium
Existing Linux network security mechanisms (e.g., iptables) only operate at the network and transport layers (i.e., IP addresses and ports) and lack visibility into the microservices layer. Cilium brings API-aware network security filtering to Linux container frameworks like Docker and Kubernetes. Using a new Linux kernel technology called BPF, Cilium provides a simple and efficient way to define and enforce both network-layer and application-layer security policies based on container/pod identity.
#5.Docker Bench
Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.The tests are all automated, and are inspired by the CIS Docker Community Edition Benchmark v1.1.0.
Script is packaged as a Docker container, just copying and pasting the docker run one-liner from its homepage can instantly see the results of ~250 checks for your running Docker containers and the host running the Docker engine.
#6.Sysdig Falco
Sysdig falco is an open source, container security monitor designed to detect anomalous activity in your applications. Falco lets you continuously monitor and detect container, application, host, and network activity.From all in one place, from one source of data, with one set of customizable rules.
#7.Notary
The Notary project comprises a server and a client for running and interacting with trusted collections. Notary aims to make the internet more secure by making it easy for people to publish and verify content.
With Notary, publishers can sign their content offline using keys kept highly secure. Once the publisher is ready to make the content available, they can push their signed trusted collection to a Notary Server.Consumers, having acquired the publisher’s public key through a secure channel, can then communicate with any notary server or (insecure) mirror, relying only on the publisher’s key to determine the validity and integrity of the received content.
#8.Sysdig Secure
Sysdig Secure takes a services-aware approach to run-time security and forensics. Bringing together deep container visibility with Docker and Kubernetes integration to block threats more effectively.
Key Features :
- Create a single policy based on application, container, host, or network activities that automatically applies to an entire service — even as containers move, grow or shrink.
- Pause or kill a container based on policy violations. Send alerts to Slack, Splunk, PagerDuty, and anywhere else with a webhook.
- Reduce noise with an intelligent feed that aggregates events.
- Examine every user command executed in a host or a container. Group, filter and search to quickly audit anomalous events.
- Snapshot of 100% of activity pre-and-post policy violation.
http://www.youtube.com/watch?v=e_kdjHjK7mY
Originally published at @upnxtblog.
