Zero CVEs at delivery: Why container security belongs in the supply chain

Container Security in the Modern Supply Chain

Containerization has revolutionized how applications are developed, deployed, and maintained. However, the increasing number of vulnerabilities in container images has created a significant challenge for developers and organizations. The National Vulnerability Database reported over 87,000 common vulnerabilities and exposures in the past year, with more than 240 new CVEs identified daily. This surge in vulnerabilities highlights the need for a more secure and automated approach to container image management.

The Risks of Unmaintained Container Images

Even seemingly harmless applications can become security risks when deployed on outdated or unmaintained container images. These images often include unnecessary components that are not required for the application to function. For example, a simple utility may include tools like curl, Bash, or an interactive package manager, which are not needed but can introduce vulnerabilities. Attackers can exploit these vulnerabilities to gain access to host infrastructure, making it imperative to address container security proactively.

Red Hat Hardened Images: A Secure Alternative

Red Hat Hardened Images offer a solution to the problem of container vulnerabilities by redesigning how container images are built and delivered. These images are minimal and distroless, reducing the attack surface by eliminating nonessential tools. If an image does not require a shell to run the application, it does not contain one. This approach significantly reduces the risk of exploitation.

Automated Supply Chain Controls

Beyond minimizing the attack surface, Red Hat Hardened Images are backed by SLSA Level 3 supply chain controls, ensuring the integrity and authenticity of the images. Each image is signed with cosign and includes a verifiable software bill of materials. This automated supply chain ensures that images remain secure over time, even as new vulnerabilities are discovered.

Efficient and Scalable Security

The automated pipeline behind Red Hat Hardened Images ensures that vulnerability fixes are delivered quickly. While the official service level objective targets 80% of fixes within seven days, the median time for patch delivery is just 18 hours. This rapid response time helps developers stay ahead of potential threats without the need for manual intervention.

Practical Implementation

Implementing Red Hat Hardened Images is straightforward. Developers can modify their Dockerfile to use the Go builder and static images, significantly reducing the container size. For example, a container that was previously 218 MB can be reduced to 35 MB with minimal changes. Automated workflows can be set up to pull updated hardened images daily, ensuring that applications are always up to date with the latest security patches.

Conclusion

Container security is a critical aspect of modern software development. Red Hat Hardened Images provide a secure, efficient, and scalable solution to the growing challenge of managing vulnerabilities in containerized applications. By integrating container security into the supply chain, developers can ensure that their applications remain secure without the need for manual patching or constant monitoring.

Source: Red Hat. Analysis based on publicly available information; no hands-on testing is claimed.