This document discusses operational considerations for using containers in an enterprise setting. It covers topics like images, registries, security, operations, development, and infrastructure. Specifically, it highlights challenges around image scanning, integrity and secrets, security issues with 'docker == root', and operational concerns like provisioning, configuration management, monitoring, and logging. It also reviews how tools like Docker Trusted Registry, Docker Cloud, and the CIS Docker Security Benchmark can help address some of these challenges.

1. May 3, 2017
Operational Considerations
for Containers
Chris Swan
VP, CTO Global Delivery Organisation

2. May 3, 2017
With thanks to Ian Miell
‘A Checklist for Docker in the Enterprise’
was the inspiration for this talk
https://zwischenzugs.wordpress.com/2016/07/08/a-checklist-for-docker-in-the-enterprise/
Shortlink: is.gd/IMDoCL
Ian Miell Docker Check List

3. May 3, 2017
Why me?
Using Docker since v0.53 (summer of 2013).
Built Docker in to a commercial networking platform as its
plugin mechanism in early 2014 (with customers in production
before v1.0 launch at first DockerCon).
Now using containers to help reskill a 120,000 strong delivery
organisation for a world of Infrastructure as Code.

4. May 3, 2017
‘Installation is a software hate
crime’
Pat Kerpan
(then Borland CTO)
c. 2004

5. May 3, 2017
The Containers Learning Cliff
Credit: Michael Ducy @mfdii https://twitter.com/mfdii/status/697532387240996864

6. May 3, 2017
Images
Registry
Scanning
Image Building
Image Integrity
Base Images
Third Party Images
SDLC
Secrets
Some (but not all) of this can be handled by
Docker Trusted Registry (DTR) or Docker Cloud

7. May 3, 2017
Operations
Provisioning (Orchestration)
Config Management (Inside and Out)
Monitoring
Logging
Or use a PaaS?

8. May 3, 2017
Security and Audit
docker == root
Security Monitoring
Forensics
The CIS Docker Security Benchmark
has guidance for host config, container config etc.
Many aspects can be checked with the DockerBench tool

9. May 3, 2017
Development
Dev Environments
CI/CD

10. May 3, 2017
Infrastructure
Shared Storage
Networking
PaaS
Cloud Providers

11. May 3, 2017
Images
Registry
Scanning
Image Building
Image Integrity
Base Images
Third Party Images
SDLC
Secrets
Security & Audit
docker == root
Monitoring
Forensics
Operations
Provisioning
Config Management
Monitoring
Logging
Development
Dev Environments
CI/CD
Infrastructure
Shared Storage
Networking
PaaS
Cloud Providers
Review

12. May 3, 2017
ImagesLibraries
Registry
Scanning
Image Building
Image Integrity
Base Images
Third Party Images
SDLC
Secrets
Security & Audit
docker == root
Monitoring
Forensics
Operations
Provisioning
Config Management
Monitoring
Logging
Development
Dev Environments
CI/CD
Infrastructure
Shared Storage
Networking
PaaS
Cloud Providers
Coda - what does ServerLess take away?

13. May 3, 2017
Questions?