How does Okera ensure container security?

Question

How does Okera handle the security of its containers and the images they are based on? What is its confidence it does not use compromised resources?

Answer

When concerned about the security of Okera ODAP services, the following three vectors need to be discussed:

1. Integrity of the images when they are built.

Okera relies on official base images online, as provided by Docker Hub. This image repository includes advanced features, such as the Docker Security Scanning service, that scans the images for common vulnerabilities and exposures (CVEs) using a database that is updated regularly. This ensures that the images on which the Okera services are based are safe to use.

Docker Hub also uses a trust model between the client and the repository, which ensures that images that downloaded will be checked for integrity.

2. Delivery of images to the host machines.

After building the Okera ODAP images, they are uploaded to the Okera owned release buckets in the cloud. No one but Okera can upload these images, which ensures they are not replaced with modified versions.

3. Security of running containers.

When an ODAS cluster is deployed by the Deployment Manager (DM), the virtual machines hosting the services are managed by the DM and network access is only granted to the known service ports. This shields the VMs from any non-administrative access and ensure that the local images and supporting data is not accessible to unauthorized users.

These steps ensure that the container images are safe at all steps in their lifecycle, and that the shared base images (such as Linux) are regularly checked for known vulnerabilities.