BPB Online LLP
DevOps and Containers Security
DevOps and Containers Security
US$ 19.95
The publisher has enabled DRM protection, which means that you need to use the BookFusion iOS, Android or Web app to read this eBook. This eBook cannot be used outside of the BookFusion platform.
Description
Contents
Reviews

Secure your applications and development environments with Docker and Kubernetes

Key Features
Introducing Container platforms (Docker, Kubernetes, Swarm, OpenShift
Discover how to manage high availability with Docker Swarm and Kubernetes
Learn how Docker can manage the security in images and containers
Discover how Docker can be integrated into development workflows in applications
Discover vulnerabilities in the Docker containers and images with practical examples to secure your container-based applications
Discover tools for monitoring and administration Docker and Kubernetes applications

Description
Through this book, we will introduce the DevOps tools ecosystem and the main containers orchestration tools through an introduction to some platforms such as Kubernetes, Docker Swarm, and OpenShift.
Among other topics, both good practices will be addressed when constructing the Docker images as well as best security practices to be applied at the level of the host in which those containers are executed, from Docker's own daemon to the rest of the components that make up its technological stack.
We will review the topics such as static analysis of vulnerabilities on Docker images, the signing of images with Docker Content Trust and their subsequent publication in a Docker Registry will be addressed. Also, we will review the security state in Kubernetes.
In the last section, we will review container management and administration open source tools for IT organizations that need to manage and monitor container-based applications, reviewing topics such as monitoring, administration, and networking in Docker.

What will you learn
Learn fundamental DevOps skills and tools, starting with the basic components and concepts of Docker.
Learn about Docker as a platform for the deployment of containers and Docker images taking into account the security of applications.
Learn about tools that allow us to audit the security of the machine where we execute Docker images, finding out how to secure your Docker host.
Learn how to secure your Docker environment and discover vulnerabilities and threats in Docker images.
Learn about creating and deploying containers in a security way with Docker and Kubernetes.
Learn about monitoring and administration in Docker with tools such as cadvisor, sysdig, portainer, and Rancher.

Who this book is for
This book covers different techniques to help developers improve DevOps and container security skills and can be useful for people who are involved in software development and want to learn how Docker works from a security point of view. It is recommended that readers have the knowledge about UNIX commands and they work with commands terminal.

Table of Contents
1. Getting started with DevOps
2. Container platforms
3. Managing Containers and Docker images
4. Getting started with Docker security
5. Docker host security
6. Docker images security
7. Auditing and analyzing vulnerabilities in Docker containers
8. Kubernetes security
9. Docker container networking
10. Docker container monitoring
11. Docker container administration

About the Author
José Manuel Ortega is a software engineer and security researcher with a special focus on new technologies, open source, security and testing. In recent years, he is interested in security development, especially with Python and security best practices with Docker and Kubernetes. Conferences and talks related with python, security and docker are available on his personal

Your Blog links: http://jmortega.github.io/
Your LinkedIn Profile: https://www.linkedin.com/in/jmortega1/

Language
English
ISBN
9789389423532
Cover Page
Title Page
Copyright Page
Dedication
About the Author
About the Reviewers
Acknowledgement
Preface
Errata
Table of Contents
1. Getting Started with DevOps
Structure
Objectives
What is DevOps?
DevOps methodologies
Management and planning
Development and building code
Continuous integration and testing
Automated deployment
Operations, ensuring the proper functioning in the production environment
Monitoring
Continuous Integration and Continuous Delivery
Software Delivery Pipeline
DevOps tools
DevOps and security
An introduction to DevSecOps
Conclusion
2. Container Platforms
Structure
Objectives
Docker containers
What is Docker?
Docker new features for container management
Docker architecture
Docker engine
Docker registry
Docker client
Testing Docker in the cloud
Container orchestration
Docker compose
Kubernetes
Kubernetes installation &key terms
Kubernetes cloud solutions
Docker swarm
Swarm in practice
OpenShift container platform
OpenShift as Platform as a Service
DevOps with OpenShift
OpenShift core items
Learning scenarios
Conclusion
3. Managing Containers and Docker Images
Structure
Objectives
Managing Docker images
Introducing Docker images
Docker layers
Image tags
Design considerations for Docker images
Dockerfile commands
What is a Dockerfile?
Building images from Dockerfile
Best practices writing Dockerfiles
Managing Docker containers
Search and execute a Docker image
Executing a container in background mode
Inspecting Docker containers
Optimizing Docker images
Docker’s cache
Docker build optimization
Building an application with Node.js
Reducing image size with multistage
Reducing image size with alpine Linux
Distroless images
Conclusion
4. Getting Started with Docker Security
Structure
Objectives
Docker security principles
Docker daemon attack surface
Security best practices
Execution with a non-root user
Start containers in read-only mode
Disable setuid and setgid permissions
Verifying images with content trust
Resource limitation
Docker capabilities
Listing all capabilities
Add and drop capabilities
Disabling ping in a container
Adding capability for managing network
Execution of privileged containers
Docker content trust
Signing images mechanism
Secure download in Dockerfiles
Notary as a tool for managing images
Docker registry
What is a registry?
Docker registry in Docker hub
Creating Docker local registry
Conclusion
Questions
5. Docker Host Security
Structure
Objectives
Docker daemon security
Auditing files and directories
Kernel Linux security and SELinux
Apparmor and Seccomp profiles
Installing AppArmor on Ubuntu distributions
AppArmor in practice
AppArmorDocker-default profile
Run container without AppArmor profile
Defense in-depth
Run container with Seccomp profile
Reducing the container attack surface
Docker bench security
Execution examples with Docker bench security
Docker bench security source code
Auditing Docker host with Lynis and Dockscan
Auditing a Dockerfile
Dockscan for scanning Docker installations for security issues and vulnerabilities
Conclusion
Questions
6. Docker Image Security
Structure
Objectives
Docker hub repository
Docker security scanning
The Docker security scanning process
Open-source tools for vulnerability analysis
Continuous integration with Docker
CoreOS Clair
Dagda: the Docker security suite
OWASP dependency check
MicroScanner
Clair scanner and quay.io repository
Github repositories and Clair links
Quay.io image repository
Register in Quay.io
Analyzing Docker images with anchore engine and anchore cli
Starting Anchoreengine
Conclusion
Questions
7. Auditing and Analyzing Vulnerabilities in Docker Containers
Structure
Objectives
Docker containers threats and attacks
Dirty Cow Exploit (CVE-2016-5195)
Prevent DirtyCow with apparmor
Vulnerability jack in the box (CVE-2018-8115)
Most vulnerable packages
Analyzing vulnerabilities in Docker images
Security vulnerability classification
Alpine image vulnerability
CVE in Docker images
Vulnerable images in Docker hub
Getting CVE details with vulners API
Conclusion
Questions
8. Kubernetes Security
Structure
Objectives
Introducing Kubernetes security
Securing containers with Kubernetes
Configuring Kubernetes
Best security practices with Kubernetes
Firewall ports
Restrict the Docker pull <image> command
API authorization mode and anonymous authentication
Kubernetes dashboard
Checking network policies
Pods security policies
Managing secrets
Kubernetes engine security
Handle security risks in Kubernetes
Increasing security using containers with Kubernetes
KubeBench security and vulnerabilities
CIS Benchmarks for Kubernetes with Kube-bench
Validating workers
Validating master
Kubernetes vulnerabilities
Kubernetes security projects
Kube-hunter
Kubesec
Kubectl plugins for managing Kubernetes
kubectl-trace
Kkubctl-debug
Ksniff
kubectl-dig
Rakkess
Conclusion
Questions
9. Docker Container Networking
Structure
Objectives
Introducing container network types
Types of Docker networks
Bridge mode
Host mode
Network managing in Docker
Docker networking
Containers communication and port mapping
Configure port forwarding between container and host
Exposing ports
Creating and managing Docker networks
Docker network commands
Bridge networks
Connect container to a network
Linking containers
Linking containers within the same host with --link
Environment variables
Conclusion
Questions
10. Docker Container Monitoring
Structure
Objectives
Container statistics, metrics and events
Log management
Stats in containers
Obtain metrics using docker inspect
Events in Docker containers
Others Docker container monitoring tool
Performance monitoring with cAdvisor
cAdvisoris a monitoring tool
Performance monitoring with Dive
Container monitoring with Sysdigfalco
Behavior monitoring
Wordpress container monitoring
Launching Sysdig container
Sysdig filters
Csysdig as a tool to analyze system calls
Conclusion
Questions
11. Docker Container Administration
Structure
Objectives
Introducing container administration
Container administration with rancher
Deploying Kubernetes using Rancher
Container administration with portainer.io
Deploying Portainer to Docker Swarm Cluster
Docker Swarm administration with Portainer
Conclusion
Questions
The book hasn't received reviews yet.