Docker Part 6 - Security Demo with Docker-bench and Aquasec Trivy
Source: YouTube · Kubesimplify · published Aug 3, 2020 · 29:14
This video provides a practical demonstration of Docker security best practices, covering content trust, vulnerability scanning, and configuration hardening for production environments 0:08-0:117:13-7:23.
Key Takeaways:
• Docker Content Trust (DCT) ensures image authenticity by allowing only signed images to be pulled; enabling it prevents the download of untrusted content 4:02-4:065:18-5:32.
• Docker Bench for Security is a script that scans for common best practices, highlighting warnings regarding auditing, logging levels, and container network traffic restrictions 7:13-7:2310:04-10:14.
• Trivy serves as a comprehensive vulnerability scanner that detects OS package flaws and specific CVEs within container images like python:3.4-alpine 13:00-13:0615:54-16:00.
• Secure configurations include running containers as non-root users, verifying software checksums, and limiting resources like CPU and memory to prevent privilege escalation and abuse 23:32-23:4425:00-25:06.
The presenter encourages using these tools and techniques to secure Docker infrastructure effectively before deploying to production 28:40-28:43.
Sources:
- 0:08 Introduction to Docker security demo
- 4:02 Enabling Docker Content Trust
- 5:18 Failure to pull untrusted images
- 7:13 Introduction to Docker Bench for Security
- 10:04 Benchmark warnings and audit logs
- 13:00 Introduction to Trivy vulnerability scanner
- 15:54 Trivy scan output and CVE details
- 23:32 Running containers as non-root users
- 25:00(https://www.youtube.com/watch?v=Uj7Stxh91
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
and let me present my screen so today i will be covering docker series part six if you want to learn more about docker you can subscribe to sam's channel and go and study about my previous parts so today uh this is the guest created by me i will be going through and last time there was a request from everyone to give talker security demo so this time i will be giving the demo and in part 5 i have explained all the best practices security which docker security covers and today i will be giving a demo on it so i hope you can see my screen and i will be using ubuntu playground of katakura so you can use play with docker as well but i am using ubuntu playground so before getting into the demo part i would like to explain um one thing from this document docker.com and uh before moving on to run…