Chapter 11 — Cloud and container security: assets and context
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 From model to inventory"]
N2["11.2 Approved images"]
N3["Lab — image inventory"]
N4["11.3 Reading the result"]
N5["11.4 Context for each finding"]
N6["11.5 Owners"]
N7["Regenerating"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 From model to inventory"]
N2["11.2 Approved images"]
N3["Lab — image inventory"]
N4["11.3 Reading the result"]
N5["11.4 Context for each finding"]
N6["11.5 Owners"]
N7["Regenerating"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 From model to inventory]
|
v
[11.2 Approved images]
|
v
[Lab — image inventory]
|
v
[11.3 Reading the result]
|
v
[11.4 Context for each finding]
|
v
[11.5 Owners]
|
v
[Regenerating]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) build an inventory of running workloads and their images; (2) compare it with an approved list; (3) explain why unapproved images matter.
11.1 From model to inventory
Using the data model from chapter 4, Priya exports the workloads from the shared client cluster into a synthetic list. Each entry links a workload to the full image reference it runs. This is the asset list that was missing during the advisory search. The export covers the shared cluster first because it holds the most workloads from different teams, which is where the advisory search was slowest. Each line records the workload name and the image reference exactly as the cluster reports it, so no one retypes anything. Priya keeps the lab data small, eight workloads, so the logic can be checked by hand before it runs on a full export.
11.2 Approved images
Cobalt keeps an approved list: images built by its own pipeline, scanned and stored in its private registry. Anything else is unapproved, either pulled straight from a public registry or built outside the pipeline. Shu et al. (2017) found that many public images contained known vulnerabilities, which is why Cobalt prefers its own builds. Building in-house does not make an image safe by itself; the value comes from the pipeline's scanning and from knowing exactly what each image contains and who maintains it. An image on the approved list has a known base, a known owner and a scan record. The lab checks only membership of the list, which is the first question an advisory raises.
Lab — image inventory
"""Match running container images to the approved registry list (synthetic, stdlib only)."""
running = {"web-1": "registry.cobalt.example/web:2.4", "web-2": "registry.cobalt.example/web:2.4",
"api-1": "registry.cobalt.example/api:1.9", "booking": "docker.io/library/node:14",
"reports": "registry.cobalt.example/reports:0.7", "cron": "docker.io/library/python:3.6",
"proxy": "registry.cobalt.example/proxy:3.1", "metrics": "registry.cobalt.example/metrics:5.0"}
approved = {"registry.cobalt.example/web:2.4", "registry.cobalt.example/api:1.9",
"registry.cobalt.example/proxy:3.1", "registry.cobalt.example/metrics:5.0"}
unknown = {w: i for w, i in running.items() if i not in approved}
print(f"workloads {len(running)}, approved {len(running)-len(unknown)}, not approved {len(unknown)}")
for w, i in sorted(unknown.items()):
print(f" {w}: {i} ({'public registry' if i.startswith('docker.io') else 'internal, not on list'})")
Run with python3 lab_inventory.py. Verified output:
workloads 8, approved 5, not approved 3
booking: docker.io/library/node:14 (public registry)
cron: docker.io/library/python:3.6 (public registry)
reports: registry.cobalt.example/reports:0.7 (internal, not on list)
11.3 Reading the result
Of 8 workloads, 5 run approved images and 3 do not. Two, booking and cron, pull node:14 and python:3.6 directly from a public registry; both are old versions. One, reports, uses an internal image that was never added to the approved list. The count of approved workloads is 5 even though the approved list holds only 4 images, because web-1 and web-2 both run the same web:2.4 image. Priya points this out so readers do not mistake workload counts for image counts. The two public images are the clearest problem, since they come from outside Cobalt's pipeline and were never scanned by it, while reports is a gap in the list rather than in the build process.
11.4 Context for each finding
Priya adds context: booking faces the internet and handles appointments, so it matters most; cron sends files to a partner; reports is internal. Context decides the order of fixes. The same finding can matter very differently depending on what the workload does and who can reach it. Booking accepts traffic from patients through the proxy and stores appointment data, so a flaw there could expose patient contact details. Cron is not reachable from the internet but moves files across a boundary to a partner. Reports never faces the internet and its image comes from Cobalt's own build process, so its fix is mainly a matter of adding it to the list after a scan.
11.5 Owners
Each unapproved image is assigned to the team that deploys it, with a target date. For booking, the owner is the team that maintains Riverside Dental's booking system, with a target of two weeks to rebuild on a supported base. Cron's owner must coordinate with the partner that receives its files, and the reports owner only needs to run the image through the pipeline scan and request its addition to the list. Owners and dates are written in the inventory itself, so the nightly export shows whether each finding is still open.
Regenerating
Priya schedules the export to run nightly so the inventory always reflects what runs.
Worked example
The booking team says node:14 "works fine". Priya explains that it no longer receives security updates and that the advisory applies to it. They agree to rebuild on a supported base through the pipeline within two weeks.
Synthetic case. Workloads and images are synthetic.
Errors and limits
An inventory taken once goes stale; it must be regenerated regularly.
Exercises
- EX031 — Lab counts. How many workloads ran unapproved images, and which? Rubric: 3 = 3: booking, cron, reports; 2 = two named; 1 = count only; 0 = none.
- EX032 — Fix order. Which unapproved workload should be fixed first and why? Rubric: 3 = booking; internet-facing, appointments; 2 = partial; 1 = vague; 0 = none.
- EX033 — Public image risk. What did Shu et al. (2017) find that supports private builds? Rubric: 3 = many public images had known vulnerabilities; 2 = partial; 1 = vague; 0 = none.
Synthesis
An inventory linked to an approved list turns advisories into quick lookups.
Continue studying — chapter 11 of 30
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →