Container Security Tools Breakdown

Container security was initially a big obstacle to many organizations in adopting Docker. However, that has changed over the past year, as many open source projects, startups, cloud vendors, and even Docker itself have stepped up to the challenge by creating new solutions for hardening Docker environments. Today, there is a wide range of security tools that cater to every aspect of the container lifecycle. Docker security tools fall into these categories:

Kernel security tools: These tools have their origins in the work of the open source Linux community. They have been inherited by container systems like Docker as foundational security tools at the kernel level.
Image scanning tools: Docker Hub is the most popular container registry, but there are many others, too. Most registries now have solutions for scanning container images for known vulnerabilities.
Orchestration security tools: Kubernetes and Docker Swarm are the two most popular orchestrators, and their security features have been gaining strength over the past year.
Network security tools: In a distributed system powered by containers, the network is more important than ever. Policy-based network security is gaining prominence over perimeter-based firewalls.
Security benchmark tools: The Center for Internet Security (CIS) has provided guidelines for container security, which have been adopted by Docker Bench and similar benchmark security tools.
Security with CaaS platforms: AWS ECS, GKE and other CaaS platforms build on the security features of their parent IaaS platform, and then add container-specific features or borrow security features from Docker or Kubernetes.
Purpose-built container security tools: This is the most advanced option for container security. In it, machine learning takes center stage as these tools look to build an intelligent solution to container security.

Here’s a cheatsheet of Docker security tools available as of mid-2017. It’s organized according to which part of the Docker stack the tool secures.

Security tool

What it does

Kernel security tools

Isolates neighboring processes from each other. It limits what a container can see, and thus prevents attacks from spreading.

Limits the resources used by a container. Restricts what a container can use, and thus prevents infected containers from hogging all resources.

Provides access control to the kernel. It enforces mandatory access control (MAC), which controls how containers access the kernel based on policies.

Enables access controls on processes. Can be set to enforce policies, or merely report on policy violations.

Allows processes to interact with the kernel in a “secure” state, where it can only make a few commands. If it goes beyond these commands, the process is killed.

Image scanning tools

Docker Hub Security Scanning

Scans images that have been downloaded from Docker Hub against a list of Common Vulnerabilities and Exposures (CVEs).

Docker Content Trust

Verifies images downloaded from third-party registries based on the author. The author of an image can be an individual or an organization.

Quay Security Scanner

Powered by CoreOS Clair, this is Quay’s version of Docker Security Scanning. It scans container images for vulnerabilities.

Part of AWS ECS, ECR encrypts images at rest in S3, and in transit over HTTPS. It Uses AWS IAM to manage access control to the registry.

Orchestration security tools

Docker Swarm Secrets Management

Provides a safe way to store passwords, tokens and other confidential data using Docker Swarm.

Kubernetes Security Context

Secures containers and pods in a Kubernetes cluster. Provides access control, and Linux kernel security modules like SELinux and AppArmor.

Network security tools

Secures the container network by providing policy-based security that ensures services can access only the services and resources they need and not more.

Enforces policy-based security for the container network, and provides a firewall for each container rather than firewalling the entire environment.

Integrates the security features of Project Calico and the connectivity features of Flannel to provide a comprehensive networking solution for containers.

Security benchmark tools

A script that checks containers in production against a list of benchmarks created by the CIS (Center for Internet Security).

A test framework built by Chef that treats compliance and security as code. It scans images, and has its own version of Docker Bench.

Security with CaaS platforms

Runs containers inside a virtual machine, which provides the first layer of security. Also adds AWS security features like IAM, security groups, and network ACLs.

Azure Container Service

Has its own Azure Container Registry for scanning images, and leverages Azure’s default security features like IAM.

Adopts Kubernetes’ security features and adds some of its own Google Cloud security features like IAM and RBAC.

Purpose-built container security tools

End-to-end security platform for containers. It leverages machine learning to automatically profile applications.

End-to-end security platform for containers. It provides a mature API that can be easily extended.

Scans container images, and enforces security policies for container platforms. Integrates with CI/CD workflows using Jenkins.

Secures container runtimes by enforcing policies for services. It can automatically start and stop containers based on automated whitelists.

CI/CD integrated security tool that protects against known attacks.

Container security tool that leverages machine learning to provide what it calls “adaptive threat protection.”

A hosted security solution that scans container images and even allows enterprises to enforce security policies on their environments.

A continuous security assessment tool that scans for vulnerabilities against the CIS benchmark, and more.

Making Sense of the Docker Security Tool Landscape

Compare architectures, feature sets, and usability of Kubernetes and Docker Swarm. Download the guide This is truly a diverse list of Docker security tools. What becomes clear when we view this list is that Docker security requires a combination of many tools working together. Each tool has its own strengths and focus areas. There are solutions available for every layer of the container stack—kernel, registries, network, orchestration, and CaaS platforms. And the best part is that most of these tools are great at integrating with each other, or at least the most commonly used tools in container workloads. By knowing each of the tools, and what makes them unique from the others, you can ensure a bulletproof container environment that can run production workloads at enterprise scale. That was always the promise of Docker, and container security tools are making that promise a reality. Twain began his career at Google, where, among other things, he was involved in technical support for the AdWords team. His work involved reviewing stack traces, and resolving issues affecting both customers and the Support team, and handling escalations. Later, he built branded social media applications, and automation scripts to help startups better manage their marketing operations. Today, as a technology journalist he helps IT magazines, and startups change the way teams build and ship applications.

快速开启您的Rancher之旅