Skip to main content

Container Security Practices and Recommendations


References
https://success.docker.com/article/security-best-practices

Description

Aspects
The micro services running (inside Pod/ Container environment) should be having restricted access to resources and priviledges.

RBAC
Network Access
3rd Party access to system resources

Security aspects available in Kubernetes
Pod security policy  

Comments

Popular posts from this blog

SCTP - A new transport protocol

SCTP is a new transport protocol, also used for LTE Signalling S1-MME interface between eNB and MME (core network) and MME -HSS (Diameter / SCTP). 1 SCTP Protocol SCTP Packet is located after the MAC/ IP header. The basic SCTP Header consist of Source / Destination Ports (16 bits each), Verification Tag (32 bits) and check sum (32 bits) Verification Tag is used by the receiver to validate the senders authenticity, this get published by each endpoint to remote end duing the 4 way handshake done initially for setting up SCTP association. 1.1 4-Way handshake Msgs 1.1.1 INIT - Contains Initiate Tag, receiver window, in/out bound streams, initial TSN 1.1.2 INIT-ACK - Contains all params same as INIT msg also contains the State Cookie 1.1.3 COOKIE-ECHO - Contains Cookie same as received in INIT-ACK 1.1.4 COOKIE-ACK - Contains nothing, used to acknowledge receipt of COOKIE-ECHO Completion of above 4 SCTP msgs bring the SCTP association to an established stat...

4G embracing of network slicing concept

4G steps towards moving into world of network slicing with different options to utilize the opportunities which cloud/ virtualization market unleashing. Final destination to 5G architecture, where the network slicing is build-in with NSSF introduction in 3GPP. CUPS – Control User Place Separation of 4G network. This attempts to separate the Control and User Place at SGW/ PGW to achieve better control and resource requirements for network deployments. (e)DÉCOR – (enhanced) Dedicated Core Network allocation DÉCOR – R13 (No UE Changes, UE Usage Type parameter in Subscription Data … /// describes UE usage characteristics that enables the selection of a specific Dedicated Core Network (DCN).… MME uses it to map to DCN value. DCN selection at ENodeB Messages where it can be contained ULR (MME-> HSS) / IDR (HSS -> MME) / Reset (HSS -> MME) Authentication Information Answer (AIA – S6A) 29272 – S6A spec - If the MME or SGSN supports the Dedicated Core Netwo...