15 KiB
title, type, source-type, category, tags, date-added, video-source, audio-source, status
| title | type | source-type | category | tags | date-added | video-source | audio-source | status | ||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CTP Topic 49 Container Lifecycle Hardening Standards | cloud-learning | video | DevOps & SRE/07_Security |
|
2026-04-14 | nas:///volume2/work/Public Cloud Learning Sessions/CTP _ Topic 49_ Container Lifecycle Hardening Standards.mp4 | summarized (Gemini 摘要) |
CTP Topic 49 Container Lifecycle Hardening Standards
Source: NAS /volume2/work/Public Cloud Learning Sessions/CTP _ Topic 49_ Container Lifecycle Hardening Standards.mp4
Type: VIDEO | Category: 07_Security
Status: 🟡 Awaiting Whisper transcription → Summary
摘要
Container Lifecycle Hardening Standards
This session, led by Ashish from the Product Security Group, covers Micro Focus security standards for container lifecycle hardening. The focus is on building containers, with deploying and running containers to be covered in a subsequent session. The goal is to provide practical guidance, highlighting risks and mitigations, supplemented by demos.
[slide:1] [slide:2] [slide:3]
The scope of the hardening standards document defines security standards for the building, deploying, and running stages of the container lifecycle. The presentation aims to simplify the detailed document, providing an introduction to the standards, associated risks, and mitigation strategies, along with demos.
[slide:4]
The session focuses on 11 standards for building container images:
- Start from a Micro Focus base image.
- Use an init system.
- Ensure images do not contain sensitive information.
- Use a read-only container file system.
- Use empty volume for temporary file systems having system information.
- Image scanning for vulnerability source inspection.
- Ensure containers run a single application.
- Disable access to Kubernetes API.
- Use private service account and our namespace role and role binding.
- Avoid use of host networking.
- Avoid use of host port.
[slide:5] [slide:6]
Key Standards and Mitigations
Micro Focus Base Image: Use Micro Focus base images instead of default images to avoid vulnerabilities associated with open-source default images. Use micro focus base image which are configured to be secure with non and trust weighted components.
Init System: Employ an init system like teeny to handle signals and prevent zombie processes, which can exhaust resources. A demo illustrated how teeny prevents zombie processes in Kubernetes.
Sensitive Information: Avoid including sensitive data in container images. Instead, use secret management capabilities like Kubernetes secrets and fetch the information during runtime.
Read-Only File System: Implement a read-only container file system to protect against malicious attacks. A demo showed how setting the readOnlyRootFilesystem flag to true prevents unauthorized file creation.
Empty Volume: Use emptyDir volumes for temporary files with sensitive information, instead of host paths, to ensure data is cleaned up when the pod is removed.
Image Scanning: Utilize image scanning tools to identify vulnerabilities and mitigate potential issues.
Single Application: Run only one application per container to prevent process interference if one application is compromised. If one application is compromised process in one application can interfere with the process of other application in the same container.
Kubernetes API Access: Disable access to the Kubernetes API within containers unless necessary, to limit the impact of potential compromises. This can be achieved by setting automountServiceAccountToken to false.
Private Service Account: Use private service accounts with specific roles instead of default service accounts to control permissions and minimize privilege escalation.
Host Networking and Ports: Avoid using host networking and host ports to prevent port conflicts and maintain network isolation.
[slide:7] [slide:8] [slide:9] [slide:10] [slide:11] [slide:12] [slide:13] [slide:14] [slide:15] [slide:16] [slide:17] [slide:18] [slide:19] [slide:20] [slide:21] [slide:22] [slide:23] [slide:24] [slide:25] [slide:26] [slide:27] [slide:28] [slide:29] [slide:30] [slide:31] [slide:32] [slide:33] [slide:34] [slide:35] [slide:36] [slide:37] [slide:38] [slide:39] [slide:40] [slide:41] [slide:42] [slide:43] [slide:44] [slide:45] [slide:46] [slide:47] [slide:48] [slide:49] [slide:50] [slide:51] [slide:52] [slide:53] [slide:54] [slide:55] [slide:56] [slide:57] [slide:58] [slide:59] [slide:60] [slide:61] [slide:62] [slide:63] [slide:64] [slide:65] [slide:66] [slide:67] [slide:68] [slide:69] [slide:70] [slide:71] [slide:72] [slide:73] [slide:74] [slide:75] [slide:76] [slide:77] [slide:78] [slide:79] [slide:80] [slide:81] [slide:82] [slide:83] [slide:84] [slide:85] [slide:86] [slide:87] [slide:88] [slide:89] [slide:90] [slide:91] [slide:92] [slide:93] [slide:94] [slide:95] [slide:96] [slide:97] [slide:98] [slide:99] [slide:100] [slide:101] [slide:102] [slide:103] [slide:104] [slide:105] [slide:106] [slide:107] [slide:108] [slide:109] [slide:110] [slide:111] [slide:112] [slide:113] [slide:114] [slide:115] [slide:116] [slide:117] [slide:118] [slide:119] [slide:120] [slide:121] [slide:122] [slide:123] [slide:124] [slide:125] [slide:126] [slide:127] [slide:128] [slide:129] [slide:130] [slide:131] [slide:132] [slide:133] [slide:134] [slide:135] [slide:136] [slide:137] [slide:138] [slide:139] [slide:140] [slide:141] [slide:142] [slide:143] [slide:144] [slide:145] [slide:146] [slide:147] [slide:148] [slide:149] [slide:150] [slide:151] [slide:152] [slide:153] [slide:154] [slide:155] [slide:156] [slide:157] [slide:158] [slide:159] [slide:160] [slide:161] [slide:162] [slide:163] [slide:164] [slide:165] [slide:166] [slide:167] [slide:168] [slide:169] [slide:170] [slide:171] [slide:172] [slide:173] [slide:174] [slide:175] [slide:176] [slide:177] [slide:178] [slide:179] [slide:180] [slide:181] [slide:182] [slide:183] [slide:184] [slide:185] [slide:186] [slide:187] [slide:188] [slide:189] [slide:190] [slide:191] [slide:192] [slide:193] [slide:194] [slide:195] [slide:196] [slide:197] [slide:198] [slide:199] [slide:200] [slide:201] [slide:202] [slide:203] [slide:204] [slide:205] [slide:206] [slide:207] [slide:208] [slide:209] [slide:210] [slide:211] [slide:212] [slide:213] [slide:214] [slide:215] [slide:216] [slide:217] [slide:218] [slide:219] [slide:220] [slide:221] [slide:222] [slide:223] [slide:224] [slide:225] [slide:226] [slide:227] [slide:228] [slide:229] [slide:230] [slide:231] [slide:232] [slide:233] [slide:234] [slide:235] [slide:236] [slide:237] [slide:238] [slide:239] [slide:240] [slide:241] [slide:242] [slide:243] [slide:244] [slide:245] [slide:246] [slide:247] [slide:248] [slide:249] [slide:250] [slide:251] [slide:252] [slide:253] [slide:254] [slide:255] [slide:256] [slide:257] [slide:258] [slide:259] [slide:260] [slide:261] [slide:262] [slide:263] [slide:264] [slide:265] [slide:266] [slide:267] [slide:268] [slide:269] [slide:270] [slide:271] [slide:272] [slide:273] [slide:274] [slide:275] [slide:276] [slide:277] [slide:278] [slide:279] [slide:280] [slide:281] [slide:282] [slide:283] [slide:284] [slide:285] [slide:286] [slide:287] [slide:288] [slide:289] [slide:290] [slide:291] [slide:292] [slide:293] [slide:294] [slide:295] [slide:296] [slide:297] [slide:298] [slide:299] [slide:300] [slide:301] [slide:302] [slide:303] [slide:304] [slide:305] [slide:306] [slide:307] [slide:308] [slide:309] [slide:310] [slide:311] [slide:312] [slide:313] [slide:314] [slide:315] [slide:316] [slide:317] [slide:318] [slide:319] [slide:320] [slide:321] [slide:322] [slide:323] [slide:324] [slide:325] [slide:326] [slide:327] [slide:328] [slide:329] [slide:330] [slide:331] [slide:332] [slide:333] [slide:334] [slide:335] [slide:336] [slide:337] [slide:338] [slide:339] [slide:340] [slide:341] [slide:342] [slide:343] [slide:344] [slide:345] [slide:346] [slide:347] [slide:348] [slide:349] [slide:350] [slide:351] [slide:352] [slide:353] [slide:354] [slide:355] [slide:356] [slide:357] [slide:358] [slide:359] [slide:360] [slide:361] [slide:362] [slide:363] [slide:364] [slide:365] [slide:366] [slide:367] [slide:368] [slide:369] [slide:370] [slide:371] [slide:372] [slide:373] [slide:374] [slide:375] [slide:376] [slide:377] [slide:378] [slide:379] [slide:380] [slide:381] [slide:382] [slide:383] [slide:384] [slide:385] [slide:386] [slide:387] [slide:388] [slide:389] [slide:390] [slide:391] [slide:392] [slide:393] [slide:394] [slide:395] [slide:396] [slide:397] [slide:398] [slide:399] [slide:400] [slide:401] [slide:402] [slide:403] [slide:404] [slide:405] [slide:406] [slide:407] [slide:408] [slide:409] [slide:410] [slide:411] [slide:412] [slide:413] [slide:414] [slide:415] [slide:416] [slide:417] [slide:418] [slide:419] [slide:420] [slide:421] [slide:422] [slide:423] [slide:424] [slide:425] [slide:426] [slide:427] [slide:428] [slide:429] [slide:430] [slide:431] [slide:432] [slide:433] [slide:434] [slide:435] [slide:436] [slide:437] [slide:438] [slide:439] [slide:440] [slide:441] [slide:442] [slide:443] [slide:444] [slide:445] [slide:446] [slide:447] [slide:448] [slide:449] [slide:450] [slide:451] [slide:452] [slide:453] [slide:454] [slide:455] [slide:456] [slide:457] [slide:458] [slide:459] [slide:460] [slide:461] [slide:462] [slide:463] [slide:464] [slide:465] [slide:466] [slide:467] [slide:468] [slide:469] [slide:470] [slide:471] [slide:472] [slide:473] [slide:474] [slide:475] [slide:476] [slide:477] [slide:478] [slide:479] [slide:480] [slide:481] [slide:482] [slide:483] [slide:484] [slide:485] [slide:486] [slide:487] [slide:488] [slide:489] [slide:490] [slide:491] [slide:492] [slide:493] [slide:494] [slide:495] [slide:496] [slide:497] [slide:498] [slide:499] [slide:500] [slide:501] [slide:502] [slide:503] [slide:504] [slide:505] [slide:506] [slide:507] [slide:508] [slide:509] [slide:510] [slide:511] [slide:512] [slide:513] [slide:514] [slide:515] [slide:516] [slide:517] [slide:518] [slide:519] [slide:520] [slide:521] [slide:522] [slide:523] [slide:524] [slide:525] [slide:526] [slide:527] [slide:528] [slide:529] [slide:530] [slide:531] [slide:532] [slide:533] [slide:534] [slide:535] [slide:536] [slide:537] [slide:538] [slide:539] [slide:540] [slide:541] [slide:542] [slide:543] [slide:544] [slide:545] [slide:546] [slide:547] [slide:548] [slide:549] [slide:550] [slide:551] [slide:552] [slide:553] [slide:554] [slide:555] [slide:556] [slide:557] [slide:558] [slide:559] [slide:560] [slide:561] [slide:562] [slide:563] [slide:564] [slide:565] [slide:566] [slide:567] [slide:568] [slide:569] [slide:570] [slide:571] [slide:572] [slide:573] [slide:574] [slide:575] [slide:576] [slide:577] [slide:578] [slide:579] [slide:580] [slide:581] [slide:582] [slide:583] [slide:584] [slide:585] [slide:586] [slide:587] [slide:588] [slide:589] [slide:590] [slide:591] [slide:592] [slide:593] [slide:594] [slide:595] [slide:596] [slide:597] [slide:598] [slide:599] [slide:600] [slide:601] [slide:602] [slide:603] [slide:604] [slide:605] [slide:606] [slide:607] [slide:608] [slide:609] [slide:610] [slide:611] [slide:612] [slide:613] [slide:614] [slide:615] [slide:616] [slide:617] [slide:618] [slide:619] [slide:620] [slide:621] [slide:622] [slide:623] [slide:624] [slide:625] [slide:626] [slide:627] [slide:628] [slide:629] [slide:630] [slide:631] [slide:632] [slide:633] [slide:634] [slide:635] [slide:636] [slide:637] [slide:638] [slide:639] [slide:640] [slide:641] [slide:642] [slide:643] [slide:644] [slide:645] [slide:646] [slide:647] [slide:648] [slide:649] [slide:650] [slide:651] [slide:652] [slide:653] [slide:654] [slide:655] [slide:656] [slide:657] [slide:658] [slide:659] [slide:660] [slide:661] [slide:662] [slide:663] [slide:664] [slide:665] [slide:666] [slide:667] [slide:668] [slide:669] [slide:670] [slide:671] [slide:672] [slide:673] [slide:674] [slide:675] [slide:676] [slide:677] [slide:678] [slide:679] [slide:680] [slide:681] [slide:682] [slide:683] [slide:684] [slide:685] [slide:686] [slide:687] [slide:688] [slide:689] [slide:690] [slide:691] [slide:692] [slide:693] [slide:694] [slide:695] [slide:696] [slide:697] [slide:698] [slide:699] [slide:700] [slide:701] [slide:702] [slide:703] [slide:704] [slide:705] [slide:706] [slide:707] [slide:708] [slide:709] [slide:710] [slide:711] [slide:712] [slide:713] [slide:714] [slide:715] [slide:716] [slide:717] [slide:718] [slide:719] [slide:720] [slide:721] [slide:722] [slide:723] [slide:724] [slide:725] [slide:726] [slide:727] [slide:728] [slide:729] [slide:730] [slide:731] [slide:732] [slide:733] [slide:734] [slide:735] [slide:736] [slide:737] [slide:738] [slide:739] [slide:740] [slide:741] [slide:742] [slide:743] [slide:744] [slide:745] [slide:746] [slide:747] [slide:748] [slide:749] [slide:750] [slide:751] [slide:752] [slide:753] [slide:754] [slide:755] [slide:756] [slide:757] [slide:758] [slide:759] [slide:760] [slide:761] [slide:762] [slide:763] [slide:764] [slide:765] [slide:766] [slide:767] [slide:768] [slide:769] [slide:770] [slide:771] [slide:772] [slide:773] [slide:774] [slide:775] [slide:776] [slide:777] [slide:778] [slide:779] [slide:780] [slide:781] [slide:782] [slide:783] [slide:784] [slide:785] [slide:786] [slide:787] [slide:788] [slide:789] [slide:790] [slide:791] [slide:792] [slide:793] [slide:794] [slide:795] [slide:796] [slide:797] [slide:798] [slide:799] [slide:800] [slide:801] [slide:802] [slide:803] [slide:804] [slide:805] [slide:806] [slide:807] [slide:808] [slide:809] [slide:810] [slide:811] [slide:812] [slide:813] [slide:814] [slide:815] [slide:816] [slide:817] [slide:818] [slide:819] [slide:820] [slide:821] [slide:822] [slide:823] [slide:824] [slide:825] [slide:826] [slide:827] [slide:828] [slide:829] [slide:830] [slide:831] [slide:832] [slide:833] [slide:834] [slide:835] [slide:836] [slide:837] [slide:838] [slide:839] [slide:840] [slide:841] [slide:842] [slide:843] [slide:844] [slide:845] [slide:846] [slide:847] [slide:848] [slide:849] [slide:850] [slide:851] [slide:852] [slide:853] [slide:854] [slide:855] [slide:856] [slide:857] [slide:858] [slide:859] [slide:860] [slide:861] [slide:862] [slide:863] [slide:864] [slide:865] [slide:866] [slide:867] [slide:868] [slide:869] [slide:870] [slide:871] [slide:872] [slide:873] [slide:874] [slide:875] [slide:876] [slide:877] [slide:878] [slide:879] [slide:880] [slide:881] [slide:882] [slide:883] [slide:884] [slide:885] [slide:886] [slide:887] [slide:888] [slide:889] [slide:890] [slide:891] [slide:892] [slide:893] [slide:894] [slide:895] [slide:896] [slide:897] [slide:898] [slide:899] [slide:900] [slide:901] [slide:902] [slide:903] [slide:904] [slide:905] [slide:906] [slide:907] [slide:908] [slide:909] [slide:910] [slide:911] [slide:912] [slide:913] [slide:914] [slide:915] [slide:916] [slide:917] [slide:918] [slide:919] [slide:920] [slide:921] [slide:922] [slide:923] [slide:924] [slide:925] [slide:926] [slide:927] [slide:928] [slide:929] [slide:930] [slide:931] [slide:932] [slide:933] [slide:934] [slide:935] [slide:936] [slide:937] [slide:938] [slide:939] [slide:940] [slide:941] [slide:942] [slide:943] [slide:944] [slide:945] [slide:946] [slide:947] [slide:948] [slide:949] [slide:950] [slide:951] [slide:952] [slide:953] [slide:954] [slide:955] [slide:956] [slide:957] [slide:958] [slide:959] [slide:960] [slide:961] [slide:96
关键概念
行动项
相关视频
配对视频笔记链接（生成后填入）
最后更新: 2026-04-14