#security (2024-11)

one account for all new builds and a separate account for all PROD images, only promote to prod automatically for clean scans or when manually triggered (to allow for CVE exceptions)

Better image scanning: the built in ECR scanner is not so good. last time I checked it was Clair, which misses a lot of packages. use something like trivy instead.

Minimal images: if you scan you’ll find hundreds of vulns and very little time to fix / upgrade. one way to get around this with lower friction with devs is to prepare a set of minimal base images for the frameworks devs use (alpine based images with the framework version they use and common runtime dependencies) then keep releasing new base images every couple of months with the latest patches. but be careful this might break apps that depend on runtime or OS packages but will slash hunderds of vulnerabilities and make the secure. option for devs the path of least resistance

you can also give cloud native buildpacks a shot

I haven’t used them, but https://www.chainguard.dev/ looks really interesting

You need to consider all aspects of your container and app lifecycle. Take a look at https://www.deepfence.io for runtime scanning. I wrote a short article mentioning some of the areas to consider. https://ctrltilde.com/container-security-101/