awesome-container-security
Awesome list of resources related to container security
https://github.com/kai5263499/awesome-container-security
Last synced: about 19 hours ago
JSON representation
Build Management
Commercial solutions
- KubeStellar Console - Multi-cluster Kubernetes dashboard with AI-powered operations, real-time observability, and CNCF project integrations across edge and cloud clusters.
- Docker Cloud - Continuous scanning of images along with a trust mechanism
Exploits
[Dirty COW](https://dirtycow.ninja/)
- Proof of concept collection
- Dirty COW and why lying is bad even if you are the Linux kernel
- Proof of concept
[waitid](https://www.youtube.com/watch?v=IdRDFS4u2rQ)
Image
[Actuary](https://github.com/diogomonica/actuary)
- drydock - Inspired by docker-bench-security with the ability to apply custom security profiles
- Docker bench security - One of the first security linting utility for Docker
[Anchore](https://anchore.com/enterprise/)
Commercial solutions
- GrSecurity - A collection of image hardening tools
- Aqua - Full lifecycle container security management platform
- Tenable - Includes FlawCheck
- Black Duck Software
[CoreOS Clair](https://coreos.com/blog/vulnerability-analysis-for-containers.html)
- Clair: The Container Image Security Analyzer (by Joey Schorr & Quentin Machu) - Presentation about the Clair platform
- A more polished presentation of Clair at CoreOS Fest 2016
[Dramatically Reducing Software Vulnerabilities](https://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.8151.pdf)
- NIST security content automation protocol
- Extensible Configuration Checklist Description Format (XCCDF) - Goes along with the SCAP link above for specifying a security template that containers should conform to
[Port Authority Open Source Security Scanner for Docker](https://www.linkedin.com/pulse/port-authority-open-source-security-scanner-docker-srinivasan/)
Networking/Runtime
[Calico](https://www.projectcalico.org/)
[Cilium](https://github.com/cilium/cilium)
- Cilium - Container Security and Networking Using BPF and XDP - Thomas Graf, Covalent - Presentation of Cilium by its creator
Commercial solutions
[Romana](https://romana.io/)
Presentations/Posts/Articles
[Capability based sandboxing](https://archive.fosdem.org/2016/schedule/event/capsicum/)
- Awesome Object Capabilities - A language-level implementation of the capability based sandboxing methodology
- Linux port of Capsicum
[Container Performance Analysis](https://www.youtube.com/watch?v=bK9A5ODIgac)
- Evolution of Container Usage at Netflix - Also provides insight into container monitoring, logging, and security at Netflix.