Distroless Images
- Distroless Images are considered to be secure as they contain only application and its related dependencies
- Distroless java example
Docker image scanning using trivy
To install Trivy on Ubuntu 24, use the following steps[4]:
- Install the necessary packages:
sudo apt-get install wget apt-transport-https gnupg lsb-release -y
- Add the Trivy repository:
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
- Update the package list and install Trivy:
sudo apt-get update
sudo apt-get install trivy -y
These commands will install Trivy on Ubuntu 24[5]. You can verify the installation by checking the version:
trivy -v
Citations:
[1] https://aquasecurity.github.io/trivy/v0.41/getting-started/installation/
[2] https://blog.nashtechglobal.com/installing-trivy-on-different-operating-systems/
[3] https://aquasecurity.github.io/trivy/v0.18.3/installation/
[4] https://github.com/aquasecurity/trivy/discussions/7785
[5] https://gist.github.com/sanju2/00705aca2b2d8d1efebbb0c1618a6551
[6] https://www.youtube.com/watch?v=2okPeifASxs
[7] https://snapcraft.io/trivy
[8] https://www.kali.org/tools/trivy/
Docker Architecture
- Look into Docker underlying components section in the article
Podman – Alternative to Docker
- Podman is default contianer engine in Redhat, Centos, Fedora
- Podman is also OCI Complaint i.e we can run docker images on Podman
- Podman is a container technology which runs containers in
non root mode by default. - Podman runs on daemonless container technology
- Podman cli is compatible with docker
Google’s background with Container technology
- Google has been using containers much earlier even before docker
- To manage these containers in Production, Google has built orchestraion engines for internal usage such as Borg and Omega
- Google has rewritten (In Golang) a new Container Orchestration Engine which can run docker containers in Production
- Google has considered all the best practices implemented in Borg and Omega
- Google has made the Project Opensource and donated it to CNCF
