Distroless Docker Images

A presentation at Cloud Native London Meetup by Melissa McKay

DISTROLESS IMAGES Securing Your Docker Images Melissa McKay Developer Advocate @JFrog

MELISSA MCKAY Developer Advocate @JFrog @melissajmckay linkedin.com/in/melissajmckay

THE AGENDA • Container History • Containers in Real Life • Container Gotchas • Distroless Images

ALL ABOUT … CONTAINERS

SHARING LIMITED RESOURCES 1979 / 1982- chroot

PROGRESS TOWARD VIRTUALIZATION ▪ 2000 - FreeBSD jail ▪ 2004 - Solaris Zones / snapshots ▪ 2006 - Google Process Containers / cgroups ▪ 2008 - IBM LinuX Containers (LXC) ▪ 2013 - Docker (open source!) - Google LMCTFY (open source!) ▪ 2014 - Docker trades LXC for libcontainer ▪ … more stuff happened 1 201 7 a v a J 2014 Java 8 ▪ June 2015 - Open Container Project/Initiative (OCI) ○ Runtime Specification (runtime-spec) ○ Image Specification (image-spec) ▪ … even more stuff happened and is still happening!

WHAT EXACTLY IS A CONTAINER? 9

CONTAINER COMPONENTS TARBALL OF A FILESYSTEM LINUX FEATURES • namespaces • cgroups • Union File systems Mix these together to create and run a container! Voila! https://docs.docker.com/get-started/overview/ 10

FILESYSTEM DETAILS … … NOTE: On OSX, containers will actually be running in a tiny Linux VM (use screen) screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty 11

FILESYSTEM DETAILS … … 12

FILESYSTEM DETAILS 13

CONTAINER GOTCHAS 14

CONTAINER GOTCHAS - RUNNING AS ROOT 15

CONTAINER GOTCHAS - NO CONSTRAINTS 16

CONTAINER GOTCHAS - NEVER UPDATING 17

CONTAINER GOTCHAS - JAVA/JVM GOTCHAS 18

CONTAINER GOTCHAS - IMAGE BLOAT 19

DISTROLESS IMAGES - AND MULTISTAGE BUILDS • Waste Not Want Not (smaller images) • No Shell • No Exec https://github.com/GoogleContainerTools/distroless (examples) 20

MANAGING YOUR IMAGES - REMOTE BY DEFAULT https://dzone.com/refcardz/getting-started-with-container-registries START FREE: https://bit.ly/MelissaWKSHP 21

Melissa McKay
@mjmckay

1 / 19

Securing a Docker image does not just stop at securing the software you put into it, you also have to deal with the base image security issues. This is where a Distroless Docker image helps you, by reducing the potential attack vectors of your Docker image, you will end up with a more secure and scanner friendly product. In this talk, Melissa will show how you can build these “Distroless” Docker images and the advantages of doing so.