はてなブックマーク

Let’s dig deeper into this list of Kubectl plugins that we strongly feel will be very useful for anyone, especially security engineers. Stern plugin RBAC-tool Cilium Plugin Kube Policy Advisor Kubectl-ssm-secret Kubelogin Kubectl-whisper-secret Kubectl-capture Kubectl-trace Access-matrix Rolesum Cert-manager np-viewer ksniff Inspektor-Gadget Kubernetes, by design, is incredibly customizable. Kuber

As detection methodologies advance, attackers are increasingly using more complex techniques such as fileless malware. In the following article, we will see how to detect and mitigate this threat. Containers provide a number of security features that are not simply available on a normal host. One of those is the ability to make the container’s root filesystem read-only. By making the file system u

There will be cases like the serverless compute engine ECS Fargate, Google Cloud Run, etc., where some of these pieces are out of our control, so we work on a shared responsibility model. The provider is responsible for keeping the base pieces working and secured And you can focus on the upper layers. Prevention: 8 steps for shift left security Before your application inside a container is execute

Kubernetes 1.21 is about to be released, and it comes packed with novelties! Where do we begin? This release brings 50 enhancements, up from 43 in Kubernetes 1.20 and 34 in Kubernetes 1.19. Of those 50 enhancements, 15 are graduating to Stable, 14 are existing features that keep improving, and a whopping 19 are completely new. It’s great to see old features, that have been around as long as 1.4, f

Learn how to prevent security issues and optimize containerized applications by applying a quick set of Dockerfile best practices in your image builds. If you are familiar with containerized applications and microservices, you might have realized that your services might be micro; but detecting vulnerabilities, investigating security issues, and reporting and fixing them after the deployment is ma

Kubernetes 1.20 is about to be released, and it comes packed with novelties! Where do we begin? As we highlighted in the last release, enhancements now have to move forward to stability or being deprecated. As a result, alpha features that have been around since the early times of Kubernetes, like CronJobs and Kubelet CRI support, are now getting the attention they deserve. Another noteworthy fact

Kubernetes 1.19 is about to be released! And it comes packed with novelties. However, there’s something beyond the features that grabbed our attention this time. Where do we begin? Kubernetes as a project is maturing, support has been increased from nine to 12 months, and there’s a new protocol in place to ensure a steady progress on feature development. Also, many of its new features are meant to

Don’t miss out on these 12 image scanning best practices, whether you are starting to run containers and Kubernetes in production, or want to embed more security into your current DevOps workflow. One of the main challenges your teams face is how to manage container security risk without slowing down application delivery. A way to address this early is by adopting a Secure DevOps workflow. Secure

A step by step cookbook on best practices for alerting on Kubernetes platform and orchestration, including PromQL alerts examples. If you are new to Kubernetes and monitoring, we recommend that you first read Monitoring Kubernetes in production, in which we cover monitoring fundamentals and open-source tools. Interested in Kubernetes monitoring? Check these other articles with advanced topics: · t

Kubernetes 1.18 is about to be released! After the small release that was 1.17, 1.18 comes strong and packed with novelties. Where do we begin? There are new features, like the OIDC discovery for the API server and the increased support for Windows nodes, that will have a big impact on the community. We are also happy to see how some features that have been on Alpha state for too long are now bein

The fourth annual Sysdig Container Security and Usage Report looks at how global Sysdig customers of all sizes and industries are using and securing container environments. By examining how and when organizations are implementing security in the development lifecycle, we have been able to uncover some interesting data points in this year’s report. For example, we can see that 74% of organizations

Introduction When working with Kubernetes, Out of Memory (OOM) errors and CPU throttling are the main headaches of resource handling in cloud applications. Why is that? CPU and Memory requirements in cloud applications are ever more important, since they are tied directly to your cloud costs. With limits and requests, you can configure how your pods should allocate memory and CPU resources in orde

When working with containers in Kubernetes, it’s important to know what are the resources involved and how they are needed. Some processes will require more CPU or memory than others. Some are critical and should never be starved. Knowing that, we should configure our containers and Pods properly in order to get the best of both. In this article, we will see: Introduction to Kubernetes Limits and

Golden Signals are a reduced set of metrics that offer a wide view of a service from a user or consumer perspective: Latency, Traffic, Errors and Saturation. By focusing on these, you can be quicker at detecting potential problems that might be directly affecting the behavior of the application. Google introduced the term “Golden Signals” to refer to the essential metrics that you need to measure

The core engine providing runtime insights to the Sysdig platform

The core engine providing runtime insights to the Sysdig platform

The core engine providing runtime insights to the Sysdig platform

The core engine providing runtime insights to the Sysdig platform

Cloud security thought leadership, industry insights, and Sysdig news

Amazon has just announced on AWS re:Invent two new services relevant on the container ecosystem: Fargate and EKS (Elastic Kubernetes Service). With the information we have at this time, let’s explain and compare them against running Kubernetes on AWS. Google and Azure both provide managed Kubernetes clusters since a few months now. Docker announced Kubernetes support in their commercial offering j

The core engine providing runtime insights to the Sysdig platform

The core engine providing runtime insights to the Sysdig platform

Csysdig is an open source, htop-like interactive troubleshooting tool for Linux that is designed for monitoring and debugging containers. It understands Docker, Rkt and LXC containers and underlying processes and threads together with their resources usage (CPU, Memory, net and file IO, etc) – basically everything you can capture from system calls. It can also map container activity to related Kub

The core engine providing runtime insights to the Sysdig platform

The core engine providing runtime insights to the Sysdig platform

The core engine providing runtime insights to the Sysdig platform

In this article I will walk you through a problem we recently experienced with AWS Elastic Load Balancer (ELB). After quickly describing the architecture of our application and putting the issue in the proper context, I’ll jump right into the troubleshooting process. Troubleshooting this issue was definitely interesting as I used a variety of good tools (including wireshark and sysdig) to achieve