{"id":2635,"date":"2018-08-30T11:40:49","date_gmt":"2018-08-30T15:40:49","guid":{"rendered":"https:\/\/solutionsreview.com\/cloud-platforms\/?p=2635"},"modified":"2018-08-30T11:56:00","modified_gmt":"2018-08-30T15:56:00","slug":"container-failure","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/","title":{"rendered":"How To Prevent Failure In Containerized Environments"},"content":{"rendered":"<p style=\"text-align: justify\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-2636\" src=\"https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler.jpg\" alt=\"How To Prevent Failure In Containerized Environments\" width=\"800\" height=\"400\" srcset=\"https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler.jpg 800w, https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler-300x150.jpg 300w, https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler-768x384.jpg 768w, https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler-540x270.jpg 540w, https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler-162x81.jpg 162w, https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler-360x180.jpg 360w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><br \/>\nContainers have grown in popularity due to their mobility, speed, and functionality. Since they run directly on the OS kernel, users don\u2019t deal with many operations headaches. Unfortunately, containers come with a lot of security concerns. This can be absolved with proper management and tools. Also, users must understand new threats to maintain consistent security.<\/p>\n<p style=\"text-align: justify\">To help with managing and understanding threats, <a href=\"https:\/\/www.gremlin.com\/\" target=\"_blank\" rel=\"noopener\">Gremlin<\/a> created their <a href=\"https:\/\/solutionsreview.com\/cloud-platforms\/chaos-engineering-failure-becomes-reliability\/\" target=\"_blank\" rel=\"noopener\">failure-as-a-service software<\/a>. Gremlin provides users the ability to simulate failures in real time. This builds a greater understanding of system flaws. The software also allows teams to practice for a real failure or threat.<\/p>\n<p style=\"text-align: justify\">The company <a href=\"https:\/\/solutionsreview.com\/cloud-platforms\/gremlin-docker\/\" target=\"_blank\" rel=\"noopener\">recently released capabilities for containers<\/a>. Gremlin\u2019s new container attack simulation gives users the chance to experience an attack or failure in real time. This kind of experience is invaluable. I recently chatted with Gremlin\u2019s security officer, Frederic Bull, to gain a deeper understanding of container security.<\/p>\n<p style=\"text-align: justify\"><strong>What responsibility do users have when securing containers?<\/strong><\/p>\n<p style=\"text-align: justify\">Containers have all the security concerns of any other host environment, so users have the responsibility to continue to secure containers as they would their hardware hosts. But containers also add more concerns, primarily that of exposing the host upon which they reside. Care must be taken to configure host permissions as well as container configuration to ensure the host environment cannot be compromised through its resident containers.<\/p>\n<p style=\"text-align: justify\"><strong>Is there anything being overlooked in container security?<\/strong><\/p>\n<ul style=\"text-align: justify\">\n<li>Containers are relatively new and do not always support the fine granularity of configuration desired.\u00a0 An example is configuring resource quotas or tighter control on namespace access.\u00a0 There is still a great deal of reliance on host configuration for complete security.<\/li>\n<li>Many common security monitoring tools have immature container support, or lack support altogether.<\/li>\n<li>Native image signing and encryption are not available or are immature.<\/li>\n<\/ul>\n<p style=\"text-align: justify\"><strong>What new threats do you expect as containers grow in popularity?<\/strong><\/p>\n<p style=\"text-align: justify\">I expect to see many threats toward container images, both in exfiltrating data from images and in compromising the integrity of images.\u00a0 I also expect to see novel new side-channel attacks against containers run from their hosts.<\/p>\n<div class=\"widget\"><div class=\"aside-card\">\t\t\t<div class=\"textwidget\"><p><a class=\"msp-speedbump\" title=\"Download link to Managed Service Providers Buyers Guide\" href=\"https:\/\/solutionsreview.com\/cloud-platforms\/managed-service-provider-buyers-guide\/\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-1682\" src=\"https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/07\/Managed-Service-Providers-Speedbump-1.jpg\" alt=\"Download Link to Managed Service Providers Buyers Guide\" width=\"771\" height=\"170\" \/><\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n<p style=\"text-align: justify\"><strong>How can developers stay secure while using a public repository?<\/strong><\/p>\n<p style=\"text-align: justify\">Permissions for access must be solid, and a rigorous change management process must be enforced (including mandatory security and peer code review).\u00a0 How that process looks at the low level will depend somewhat on the threat model and risk profile of the application and codebase, but the process should employ technical controls to ensure compliance. Examples would be an inability to merge into critical branches without the requisite approvals and including cryptographic signing of commits to ensure proper identity-verification and non-repudiation.<\/p>\n<p style=\"text-align: justify\"><strong>How can users improve container security with Gremlin?<\/strong><\/p>\n<p style=\"text-align: justify\">Practicing proper host-level security is paramount.\u00a0 Gremlin has safeguards to protect itself from malicious host configuration, but no application can protect itself completely from a motivated attacker with sufficiently elevated access.\u00a0 This includes things like locking env variables from unauthorized users and ensuring all files and directories have appropriate \u2018least privileges\u2019 access.<\/p>\n<p style=\"text-align: justify\">It\u2019s important to ensure that only those resources that are necessary are shared between the host and containers.\u00a0 Gremlin does not require root privileges and should never be granted them. The Gremlin Help site (<a href=\"https:\/\/help.gremlin.com\/security\">https:\/\/help.gremlin.com\/security<\/a>) contains information and descriptions of all resource sharing configurations required, which generally involves granting some targeted Linux capabilities and sharing some Gremlin specific file locations.<\/p>\n<p style=\"text-align: justify\">A commonly overlooked feature of containers are Quotas, which allow restrictions on container resource usage, and direction on how to handle overages.\u00a0 Understanding how those quotas interact with the host resources is important, and a proper configuration can improve the safety around events like DOS attacks or even misconfigured or buggy code deployments.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Containers have grown in popularity due to their mobility, speed, and functionality. Since they run directly on the OS kernel, users don\u2019t deal with many operations headaches. Unfortunately, containers come with a lot of security concerns. This can be absolved with proper management and tools. Also, users must understand new threats to maintain consistent security. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2636,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[2],"tags":[809,705,704,359],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How To Prevent Failure In Containerized Environments<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Doug Atkinson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/\",\"url\":\"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/\",\"name\":\"How To Prevent Failure In Containerized Environments\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler.jpg\",\"datePublished\":\"2018-08-30T15:40:49+00:00\",\"dateModified\":\"2018-08-30T15:56:00+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/#\/schema\/person\/5992f02d38e7b28251ad933cd131dcae\"},\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler.jpg\",\"width\":800,\"height\":400,\"caption\":\"container failure\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/cloud-platforms\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How To Prevent Failure In Containerized Environments\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/#website\",\"url\":\"https:\/\/solutionsreview.com\/cloud-platforms\/\",\"name\":\"Cloud Platforms &amp; Infrastructure Services | Solutions Review\",\"description\":\"Evaluating Hyperscale Cloud Providers, Hybrid IaaS, PaaS &amp; Cloud Management Tools.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/cloud-platforms\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/#\/schema\/person\/5992f02d38e7b28251ad933cd131dcae\",\"name\":\"Doug Atkinson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/cloud-platforms\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/092cfcbe5c7f2c185c21f152aada2d2f?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/092cfcbe5c7f2c185c21f152aada2d2f?s=96&d=blank&r=g\",\"caption\":\"Doug Atkinson\"},\"description\":\"An entrepreneur and executive with a passion for enterprise technology, Doug founded Solutions Review in 2012. He has previously served as a newspaper boy, a McDonald's grill cook, a bartender, a political consultant, a web developer, the VP of Sales for e-Dialog - a digital marketing agency - and as Special Assistant to Governor William Weld of Massachusetts.\",\"sameAs\":[\"https:\/\/solutionsreview.com\"],\"url\":\"https:\/\/solutionsreview.com\/cloud-platforms\/author\/doug-atkinson-4\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How To Prevent Failure In Containerized Environments","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/","twitter_misc":{"Written by":"Doug Atkinson","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/","url":"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/","name":"How To Prevent Failure In Containerized Environments","isPartOf":{"@id":"https:\/\/solutionsreview.com\/cloud-platforms\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler.jpg","datePublished":"2018-08-30T15:40:49+00:00","dateModified":"2018-08-30T15:56:00+00:00","author":{"@id":"https:\/\/solutionsreview.com\/cloud-platforms\/#\/schema\/person\/5992f02d38e7b28251ad933cd131dcae"},"breadcrumb":{"@id":"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#primaryimage","url":"https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler.jpg","contentUrl":"https:\/\/solutionsreview.com\/cloud-platforms\/files\/2018\/08\/gremler.jpg","width":800,"height":400,"caption":"container failure"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/cloud-platforms\/container-failure\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/cloud-platforms\/"},{"@type":"ListItem","position":2,"name":"How To Prevent Failure In Containerized Environments"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/cloud-platforms\/#website","url":"https:\/\/solutionsreview.com\/cloud-platforms\/","name":"Cloud Platforms &amp; Infrastructure Services | Solutions Review","description":"Evaluating Hyperscale Cloud Providers, Hybrid IaaS, PaaS &amp; Cloud Management Tools.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/cloud-platforms\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/cloud-platforms\/#\/schema\/person\/5992f02d38e7b28251ad933cd131dcae","name":"Doug Atkinson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/cloud-platforms\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/092cfcbe5c7f2c185c21f152aada2d2f?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/092cfcbe5c7f2c185c21f152aada2d2f?s=96&d=blank&r=g","caption":"Doug Atkinson"},"description":"An entrepreneur and executive with a passion for enterprise technology, Doug founded Solutions Review in 2012. He has previously served as a newspaper boy, a McDonald's grill cook, a bartender, a political consultant, a web developer, the VP of Sales for e-Dialog - a digital marketing agency - and as Special Assistant to Governor William Weld of Massachusetts.","sameAs":["https:\/\/solutionsreview.com"],"url":"https:\/\/solutionsreview.com\/cloud-platforms\/author\/doug-atkinson-4\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/posts\/2635"}],"collection":[{"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/comments?post=2635"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/posts\/2635\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/media\/2636"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/media?parent=2635"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/categories?post=2635"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/cloud-platforms\/wp-json\/wp\/v2\/tags?post=2635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}