Container Security with Docker

[DerekYeo]

Hi all,

Does Openshift container use other container alternatives than Docker? This is because I am researching on Symantec Security product for container on docker. 

Regards,

Derek

[beelandc · Accepted solution]

Users have had the option to use the CRI-O container engine in OpenShift since version 3.7 as Tech Preview and 3.9 as Generally Available (supported). However, OpenShift 3.x defaults to docker as the underlying container engine. 

As of OpenShift 4, the platform now defaults to CRI-O as the underlying container engine. 

CRI-O (and OpenShift) still support the docker container image format.

I'm not familiar with the Symantec Security product for docker containers, but I would imagine that it would be incompatible with the CRI-O runtime.

For more information on why OpenShift 4 switched to CRI-O, check the links below:

1. http://crunchtools.com/docker-support/
2. http://crunchtools.com/why-no-docker/
3. https://www.redhat.com/en/blog/red-hat-openshift-container-platform-4-now-defaults-cri-o-underlying-...
4. https://cri-o.io/
5. http://crunchtools.com/why-no-docker/
6. https://www.projectatomic.io/blog/2017/06/6-reasons-why-cri-o-is-the-best-runtime-for-kubernetes/

[flozano]

About the container image format, it is actually the one defined by the Open Container Initiative. It is backwards-compatible with the docker container image format.

I am not aware of the Symantec product and I am curious about what it brings to container security. There is a training offering about container security: it is Red Hat Security: Securing Containers and OpenShift (DO425).

For a nice introduction about the overall landscape of container security, I recommend the following whitepaper: "Ten layers of container security"

https://www.redhat.com/en/resources/container-security-openshift-cloud-devops-whitepaper

[beelandc]

Good point on the image format. Thanks for clarifying!

[DerekYeo]

I see. So in this case, can I still use S2I to build the container images or I need to use Buildah tool? Thanks!

[beelandc]

You still have the ability to use S2I with OpenShift 4. However, under the covers, OpenShift is now using buildah inside a builder pod to create the resulting image.

https://blog.openshift.com/openshift-4-image-builds/

[flozano]

You can use either 'podman build' or 'buildah bud' to build container images using a Dockerfile under RHEL8 or RHEL7 with container tools. And as said before Dockerfile builds work on OpenShift 4 using 'oc new-app' and buildconfigs the same way they worked with OpenShift 3. The fact that OpenShift 4 uses buildah internally instead of docker is just an implementation detail form the point of view of an OpenShift user.

[Rik_NL]

This is what i get from the Symantic website on your question:

“Symantec CWP enables organizations to discover and secure workloads across multi-cloud environments.

• Continuous visibility of workloads deployed across AWS, Azure, and Google Cloud Platform (GCP)
• Automatic discovery of software services on workloads
• Automatic identification of workload security postures
• Real-time visibility into infrastructure changes”

This product line does not work AFAICS with our Openshift offerings. It also does little for when creating an image. It has no real connection to the choice of container runtime (docker, cri-o, rkt etc).

For protecting Openshift workloads (after DO180/DO280) you could take a look at Red Hat Security: Securing Containers and OpenShift .

Important to note is to take care of bits in transit, so using secure connections between nodes, deploying with a service mesh for end-to-end TLS, running container with non-root privileges, and storing bits at rest, so storing images in a secure registry that has capability to do vulnerabiblity scanning (like Quay). 

Buildah or docker build on its own do not make for a ‘secure’ image and container. This is where the Red Hat runtimes come into play to help you get safer images by lowering the attack surface.

In the end, security is not a button to press or a feature you add, it is a vital process you need to get in place to design and run your workloads save. There are tools available at all stages of the journey. Before picking a tool (like the abovementioned Symantec), first learn how the different components are interlocked. This is why we have the comprehensive learning portfolio at Red Hat. 

Enjoy the journey