Implementing DevSecOps with Docker and Kubernetes (José Manuel Ortega Candel) (Z-Library)

# Implementing DevSecOps with Docker and Kubernetes — Reading Guide ## 【One-Line Pitch】 A practical, command-driven handbook for developers who want to embed security into every stage of the container lifecycle—from building Docker images to orchestrating Kubernetes clusters—using open source tools and real-world vulnerability analysis. ## 【Book Arc】 - **Opening (~0%–9%)**: Introduces DevSecOps as a cultural and methodological shift from traditional DevOps, covering CI/CD pipelines, security testing types (SAST/DAST), and the open source tool ecosystem that supports decentralized security ownership. - **Early (~9%–26%)**: Surveys container platforms and orchestration tools (Docker, Podman, Kubernetes, Nomad), then dives into Docker image construction—layers, Dockerfile instructions, image inspection, and the security implications of image size and base image choices. - **Early-to-Middle (~26%–43%)**: Focuses on hardening containers at the host and runtime level—Linux capabilities, SELinux, AppArmor, seccomp, privileged mode risks—and introduces private registries, Notary for image signing, and registry alternatives like Quay and Harbor. - **Middle (~43%–52%)**: Moves into vulnerability analysis and threat modeling—CVSS metrics, CVE databases, scanning tools (Anchore, Deepfence), and real-world Docker vulnerabilities with patching timelines and detection scripts. - **Late (~52%–end)**: Covers secrets management, container networking security, monitoring, and administration practices for Docker and Kubernetes, closing with operational guidance for running secure container-based systems in production. ## 【Key Takeaways】 - **DevSecOps is a cultural shift, not just a toolchain** (Early): Security must be decentralized into every developer's workflow rather than gated by a separate security team—the book cites GitLab survey data showing 45% of developers still find security tests happen too late in the lifecycle. - **Image size is a security surface** (Early): Distroless images (e.g., Python at ~50MB vs. 885MB official) strip out package managers and unnecessary binaries, reducing attack surface and supply chain risk—a concrete trade-off between debuggability and security. - **Dockerfile hygiene reduces layer bloat** (Early): Combining multiple RUN instructions into a single layer (e.g., `RUN apt-get update && apt-get install vim`) is a recommended practice that minimizes image layers and simplifies vulnerability tracking. - **Root inside a container is not host root—but privileged mode changes that** (Middle): Docker containers run with limited Linux capabilities by default, but `--privileged=true` grants excessive kernel access; the book demonstrates how this allows MAC address changes and hardware access, advising capability-specific grants instead. - **Linux security modules are complementary, not optional** (Middle): AppArmor, SELinux, and seccomp each regulate different aspects—filesystem permissions, kernel access controls, and system calls—and should be layered for defense in depth. - **Vulnerability scoring is multi-dimensional** (Middle): CVSS metrics like access complexity, authentication requirements, confidentiality, and integrity impact determine severity; understanding these helps prioritize which container vulnerabilities to fix first. - **Image signing and private registries prevent tampering** (Middle): Notary enables content verification, while private registries like Quay and Harbor give teams control over image distribution—critical for production trust chains. - **Real CVEs illustrate concrete attack patterns** (Middle): The book dissects CVE-2018-8115 (Docker for Windows RCE via path validation) and older Docker daemon issues, showing how layer inspection scripts can detect vulnerable images before deployment. ## 【Reading Tips】 - **Skim the tool surveys** (Chapters 1–2): The CI/CD and container platform comparisons (Codeship, TeamCity, Nomad, etc.) are useful reference material but not the core value—read for awareness, not mastery. - **Deep-read the Dockerfile and image sections** (Early): The layer model, `docker inspect` JSON output, and distroless comparisons are foundational; practice these commands yourself to internalize the concepts. - **Pay special attention to the capability and privileged-mode discussion** (Middle): This is where the book earns its keep—the MAC address manipulation example vividly shows why `--privileged=true` is dangerous and why granular capabilities are preferred. - **Use the vulnerability chapters as a playbook** (Middle): The Anchore and Deepfence command examples are copy-paste ready; run them against your own images to build a baseline vulnerability database. - **Don't expect deep Kubernetes security** (Late): The book covers Kubernetes architecture and monitoring but is Docker-centric; supplement with dedicated Kubernetes security resources if that's your primary platform. ## 【Coverage Limits】 This guide synthesizes the first ~52% of the book in detail; the later sections on secrets management, networking, and Kubernetes monitoring are summarized from the book's stated objectives but not fully excerpted here. ##