15

Container Security

In this chapter, we will look at container security. Container security is critical for today’s enterprises because containers have become the go-to technology for deploying applications in modern IT environments. As a result, they have become a target for attackers who seek to exploit vulnerabilities in container infrastructure and applications to gain access to sensitive data or cause harm to the organization. Without proper security measures in place, containers can create significant risks for enterprises, including data breaches, system downtime, and compliance violations. By prioritizing container security and implementing best practices, enterprises can protect their applications, data, and infrastructure from cyber threats and ensure the safe and secure deployment of their workloads. Container security is considered a critical aspect of cloud security. It is a broad topic, so we will try to cover it from the exam point of view.

In this chapter...

Overview of containers

A container is a lightweight, standalone executable package that contains everything needed to run an application, including the code, runtime, libraries, and dependencies. Containers are designed to be easily portable between different computing environments, making them an ideal solution for modern application deployment. Everything at Google runs in containers, from Gmail to YouTube to Search. Development teams can now move quickly, distribute software efficiently, and operate at unprecedented scale thanks to containerization.

Containers come with security advantages inherent to their architecture:

• Containers are short-lived and frequently re-deployed
• Containers are intentionally immutable; a modified container is a default security alert
• Good security defaults are one-line changes; setting secure configurations is easy
• With isolation technologies, you can increase security without adding resources

Google invests massively in...

Container basics

Traditionally, applications used to be deployed on dedicated servers. To run an application, you would do the following:

1. Purchase hardware.
2. Install the OS.
3. Install dependencies.
4. Deploy application code.
5. Make sure the application is the same across all environments.

This took a lot of time and resources to deploy and maintain. It was not portable and was difficult to scale. VMware popularized running multiple servers and operating systems (OSs) on the same hardware using a hypervisor. Each virtual machine (VM) has its own dedicated resources, including memory, CPU, and storage, which are allocated by the hypervisor that manages them. VMs are isolated from each other and from the host machine, providing greater security and flexibility but also requiring more resources and longer startup times. Containers share the host machine’s OS kernel and use containerization technology to isolate the application from other processes running...

What is Kubernetes?

Kubernetes, also known as K8s, is an open source system for automating the deployment, scaling, and management of containerized applications. The name Kubernetes originates from Greek, meaning helmsman or pilot. In simple terms, think of K8s as the orchestrator for your container fleet. It tracks how many containers are needed, which one is performing well, and how to direct your traffic, among other things.

Here are some features provided by K8s:

• Load balancing and service discovery: Kubernetes exposes a container using an independent IP address or a DNS name. Kubernetes may load balance and spread the traffic to keep the deployment stable.
• Storage management: Kubernetes can allow you to mount storage, also called volume, that containers in the pods can read and write to; for example, on GKE you can mount volumes such as emptyDir, ConfigMap, Secret, and so on.
• Rollouts and rollbacks: Kubernetes does an automated rollout and rollback for you....

Container security

Container security is about making sure that a container-based system or workload is protected by using different security methods and technologies. This includes securing the container image during creation, securing the deployment of the image, and making sure that the container environment is secure during runtime.

Let us look at threats and risks in containers.

Threats and risks in containers

NIST defines cybersecurity risks as relating to the loss of confidentiality, integrity, and availability of information and data and its potential adverse impact on an organization or business. The NIST definition of container security risks includes the following:

• Image risks: Image configuration defects, embedded malware, embedded clear text secrets, the use of untrusted images
• Registry risks: Insecure registry connections, stale images, and inadequate authentication and authorization to the registry are common risks
• Orchestrator risks: Unrestricted...

GKE security features

The contents of your container image, the container runtime, the cluster network, and access to the cluster API server all play a role in protecting workloads in GKE. Let us understand a few security features in GKE.

Namespaces

In Kubernetes, namespaces are used to separate groups of resources in a cluster. Resources within a namespace must have unique names, but this requirement doesn’t apply across namespaces. It’s important to note that namespace-based scoping only applies to resources that are specific to a namespace, such as Deployments and Services, and doesn’t apply to objects that are used across the entire cluster, such as Nodes, StorageClass, and PersistentVolume.

Namespaces in Kubernetes are intended for situations where there are multiple users spread across different teams or projects. If your cluster only has a small number of users, you may not need to worry about namespaces.

Namespaces allow you to group resources...

Container security best practices

Here are a few general security best practices when using containers for your application development process. We will look at these in three parts: the build phase, the distribution/deployment phase, and the production/run phase. These go hand in hand with your CI/CD security:

• Security in the container build phase: This is where the container build starts:
  • Source image control: In this phase, you write the code to create a container. Follow these best practices for this phase:
    1. Avoid retrieving/using source images with unknown/untrusted publishers.
    2. If a third-party image is used, it is strongly recommended to identify and document detailed information, such as the version/build of code included and information about the creator of the image.
    3. Never include code from unverified/untrusted sources in an image.
    4. Use digital signature/checksum verification services on images whenever possible.
    5. Prior to completing image creation, all dependencies and libraries...

Summary

We covered a lot of ground in this and the previous chapter when it comes to container security. We went over the basics of CI/CD security and then we understood what containers are. Kubernetes paved the way for modernizing applications. The deployments that used to take hours are now deployed in minutes and it’s also done several times a day. Kubernetes also makes it easy to scale deployments. GKE is Google’s managed offering for Kubernetes, which takes away the pain of management and the complexity. GKE is headed toward more robust, self-healing features. Granted, container and Kubernetes security can be quite challenging to understand, but our hope is that these last two chapters made it easy for you to get a solid foundation.

Congratulations! You have reached the end of this book. We hope you’ve enjoyed reading it as much as we enjoyed putting it together. We have covered a lot of ground on the different security offerings in Google Cloud, and we...

Further reading

For more information on container security, refer to the following links:

• A simple IAP proxy for accessing a private GKE master control plane: https://packt.link/lXbwP
• Best practices for building containers: https://packt.link/UUz4G