Implementing DevSecOps with Docker and Kubernetes: An Experiential Guide to Operate in the DevOps Environment for Securing and Monitoring Container Applications

Cover Page
Title Page
Copyright Page
Dedication Page
About the Author
About the Reviewers
Acknowledgements
Preface
Errata
Table of Contents
1. Getting Started with DevSecOps
	Structure
	Objectives
	From DevOps to DevSecOps
	Getting started with DevSecOps
		Advantages of implementing DevSecOps
	DevSecOps lifecycle
		ShiftLeft security
	DevSecOps methodologies
		Applying the DevSecOps methodology
		Security testing
		Security code review
	Continuous integration and continuous delivery
		Continuous Integration (CI)
		Orchestrating CI
		Selection of continuous integration tools
		Continuous delivery (CD) - Pipelines in software development
		Advantages of continuous delivery
		Continuous Integration (CI) versus Continuous Delivery (CD)
	DevSecOps tools
		Static Analysis Security Testing (SAST)
		Dynamic Analysis Security Testing (DAST)
		Dependency analysis
		Infrastructure as Code security
		Secrets management
		Vulnerability management
		Vulnerability assessment
		Alerts and monitoring
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
2. Container Platforms
	Structure
	Objective
	Docker containers
		What is Docker?
		Containers versus virtual machines
		Docker features for container management
		Docker architecture
		Docker engine
		Docker client
		Containerd
	Podman
		Podman design and main functions
		Podman commands
	Container orchestration
		Docker compose
	Kubernetes
		Kubernetes architecture
		Kubernetes key terms
		Kubernetes cloud provider solutions
	Kubernetes alternatives
		Docker Swarm
		Nomad
		Rancher - Kubernetes as a service
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
3. Managing Containers and Docker Images
	Introduction
	Structure
	Objectives
	Managing Docker images
		Introducing Docker images
		Docker layers
			Image tags
		Design considerations for Docker Images
	Dockerfile commands
		What is a Dockerfile?
		Building images from Dockerfile
		Best practices writing DockerFiles
	Managing Docker containers
		Searching and executing a Docker image
		Executing a container in background mode
			Inspecting Docker containers
	Optimizing Docker images
		Docker’s cache
		Building an application with NodeJS
		Reducing image size with multistage
		Reducing image size with alpine Linux
		Distroless Docker images
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
4. Getting Started with Docker Security
	Introduction
	Structure
	Objectives
	Docker security principles and best practices
		Docker daemon attack surface
		Security best practices
		Execution with non-root user
		Start containers in read-only mode
		Disable the setuid and setgid permissions
		Verifying images with Docker Content Trust
		Resource limitation
	Docker capabilities
		Listing all capabilities
		Add and drop capabilities
		Disabling ping command in a container
		Adding capability for managing network
		Execution of privileged containers
	Docker Content Trust
		Notary as a tool for managing images
	Docker Registry
		What is a registry?
		Public Docker registries
		Creating Docker registry
		Quay.io image repository
		Harbor repository
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
5. Docker Host Security
	Structure
	Objectives
	Docker daemon security
		Auditing files and directories
		Kernel Linux security and SELinux
	Apparmor and Seccomp profiles
		Installing AppArmor on Ubuntu distributions
		AppArmor Docker-default profile
		Run container without AppArmor profile
		Run container with Seccomp profile
		Deny all syscalls
		Run a container with no seccomp profile
		Write a seccomp profile
			Security in-depth
		Reducing the container attack surface
	Docker bench security
		Docker bench security execution
	Auditing Docker host with Lynis
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
6. Docker Images Security
	Structure
	Objectives
	Docker Hub repository and security scanning process
		Docker security scanning
		Docker security scanning process
	Open source tools for vulnerability analysis
		Clair security scanning
		Dagda
		OWASP dependency check
		Trivy
	Scanning Docker images with Clair and Quay
		Quay.io image repository
	Analyzing Docker images with Anchore
		Deploying Anchore engine
		Policies for image evaluation
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
7. Auditing and Analyzing Vulnerabilities in Docker Containers
	Structure
	Objectives
	Docker containers threats and attacks
		Dirty Cow Exploit (CVE-2016-5195)
		Preventing DirtyCow exploit with apparmor
		Vulnerability jack in the box (CVE-2018-8115)
		Most vulnerable packages
		Analyzing vulnerabilities in Docker images
		Security vulnerability classification
		Alpine image vulnerability (CVE-2019-5021)
	CVE in Docker images
	Getting CVE details with Vulners API
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
8. Managing Docker Secrets and Networking
	Structure
	Objectives
	Introducing container secrets
		What is a secret?
	Managing secrets in Docker
		Docker secrets with Docker swarm scenario
	Introducing container networking
		Bridge mode
		Host mode
	Network managing in Docker
		Docker networking
	Containers communication and port mapping
		Configuring port forwarding between containers and Docker host
	Creating and managing Docker networks
		Docker network commands
		Creating a network
		Connecting a container to a network
		Linking containers
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
9. Docker Container Monitoring
	Structure
	Objectives
	Container statistics, metrics, and events
		Log management
		Containers stats
		Obtain metrics using docker inspect
		Events in Docker containers
		Other Docker container monitoring tools
	Performance monitoring with cAdvisor
	Performance monitoring with Dive
	Container monitoring with Falco
	Launching Falco container
		Falco rules
		Nginx container monitoring
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
10. Docker Container Administration
	Structure
	Objectives
	Introducing container administration
	Container administration with Portainer
		Deploying Portainer in Docker Swarm Cluster
		Docker Swarm Administration with Portainer
	Container administration with Rancher
		Deploying Kubernetes using Rancher
	Container administration with OpenShift
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
11. Kubernetes Architecture
	Structure
	Objectives
	Kubernetes architecture
		Components of a Kubernetes cluster
	Kubernetes objects
		Pods
		Volumes
		Deployment
		ReplicaSet
		Services
		StatefulSets
	Kubernetes networking model
		Container to container communication within Pods
		Pod to Pod communication through cluster nodes
		External communication from the Pod
	Tools for deploying Kubernetes
		Cluster election
		Working with Kubernetes using Minikube
		Interacting with the cluster using kubectl
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
12. Kubernetes Security
	Structure
	Objectives
	Introducing Kubernetes security
		Configuring Kubernetes
	Kubernetes security best practices
		Using secrets
		Firewall ports
		Restrict the Docker pull  command
		API authorization and anonymous authentication
		Management of resources and limits
		Security features built into k8s
		Managing secrets
		Kubernetes secrets
		Other projects for managing Kubernetes secrets
	Handle security risks in Kubernetes
	Analyzing Kubernetes components security
		Pod security policies
		Static analysis with kube-score
		Auditing the state of the cluster
		Using livenessProbe and readinessProbe
		Setting limits and resource requests
		Applying affinity rules between nodes and pods
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
13. Auditing and Analyzing Vulnerabilities in Kubernetes
	Structure
	Objectives
	KubeBench security
		CIS benchmarks for Kubernetes with KubeBench
	Kubernetes security projects
		Kube-hunter
	Kubesec
		Kubectl plugins for managing Kubernetes
		kubectl-trace
		Kubectl-debug
		Ksniff
		kubectl-dig
		Rakkess
		Kubestriker
		Other tools
	Analyzing Kubernetes vulnerabilities and CVEs
		Kubernetes vulnerabilities
		Vulnerability with PodSecurityPolicy
		Vulnerability in the use of certificates
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
14. Observability and Monitoring in Kubernetes
	Structure
	Objectives
	Introducing observability and monitoring
	Observability in a Kubernetes cluster
		Cluster monitoring
	Kubernetes dashboard
		Other Kubernetes Dashboards
	Enhancing observability and monitoring with Prometheus and Grafana
		Prometheus
		Prometheus architecture
		Prometheus installation
		Collecting metrics
		Exploring metrics with Grafana
		Other tools
	Conclusion
	Points to remember
	Multiple choice questions
		Answers
	Questions
	Key terms
Index