CoreOS Unveils Security Framework for Containers

10 Security Trends to Look for in 2016

Moving to address security concerns that have dogged the usage of containers in production environments, CoreOS today unveiled a Distributed Trusted Computing framework giving enterprises cryptographically guaranteed end-to-end integrity and control of their environment.

Announced at a Tectonic Summit 2015 conference, the framework is designed to support both Rkt containers as well as Docker images running on top of Rkt containers.

CoreOS CEO Alex Polvi says that one of the primary reasons that CoreOS decided to create its own containers format was to be able to provide levels of security assurance that were not being addressed by Docker containers. Since the launch of that initiative, the two main container camps have agreed on a way to move Docker images between their respective container formats.

Core capabilities of the Distributed Trusted Computing framework include the ability to verify that rkt is configured in a secure manner. Only containers signed with trusted keys are allowed to run on the cluster. Additionally, rkt uses the Trusted Platform Module (TPM) to create a cryptographically verifiable audit log of which containers have run on the system.

Finally, the CoreOS operating system is verified before boot to ensure that it has not been modified all the way down to the hardware or cloud service provider level. If it has been modified, Polvi says, it will not boot. Only machines that are booted through this entire process are allowed into the Kubernetes cluster. SSL private keys are distributed only when the machine has been verified to be in a trusted state. Those new capabilities complement Quay, a vulnerability scanning tool that CoreOS unveiled last month that is based on an open source project called Clair.

Many IT organizations have been reluctant to deploy production applications based on containers because of security concerns. In fact, to alleviate this issue, many IT organizations opt to deploy containers on top of virtual machines. But Polvi notes that, once container security issues are addressed, CoreOS expects to see the number of containers deployed on top of bare-metal servers substantially increase.

In general, containers provider a lighter-weight approach to virtualization that is easier for developers to work with while simultaneously increasing the utilization rates of servers. The degree to which containers, as part of emerging microservices architectures, will replace traditional virtual machines in the enterprise is subject to debate. What is certain is that as containers begin to proliferate across the enterprise, just about everything they interact with will to one degree or another be changed.