Learning Path
Scan container images for vulnerabilities
The use of application containers is becoming increasingly popular due to their portability and support of modern development and architecture. A 2020 survey conducted by IBM Market Development & Insights revealed that 78% of survey respondents who are currently using containers experienced improved application quality and faster response to changes in market segment, and 76% experienced faster time to market.
For those new to application containers, here is a little background. Containers are made possible due to operating system kernel features, specifically:
- Namespaces: Kernel-level isolation of processes
- cgroups: Used to control resources such as CPU, memory, network, disk I/O accessed/used by a process/set of processes
A container is software unit, consisting of application code plus its required binaries and libraries. A container is created from a container image, which is a read-only template of the content just described and is created from a configuration file known as a Dockerfile (or containerfile). This configuration file describes the necessary base container image to use and then additional commands to run on top to create the container image. Each command introduces changes to the file system of the image and creates a new layer. A layer is essentially a set of file system changes, based on the previous layer (image). A container building tool (such as Docker, Buildah, or Kaniko) creates the container image from the configuration file. Take care not to bloat container images by creating a lot of unnecessary layers. It is also possible to squash the image into a single layer using the tools previously mentioned.
Container runtime engines are used to run containers. They abstract the complexities of namespaces and cgroup creation and management from the end user, and sit between the running containers and the host system.
The next step in the journey is container orchestration, which is a system that automates container deployment, scaling, and the management of containerized applications. Kubernetes is an orchestration tool that interacts with and utilizes the container runtime engine to create containers, but crucially provides the ability to set scaling requirements, replace failed containers, and schedule across a cluster of nodes, amongst other functions.