connaisseur
An admission controller that integrates Container Image Signature Verification into a Kubernetes cluster (by sse-secure-systems)
docker-bench-security
The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production. (by docker)
| connaisseur | docker-bench-security | |
|---|---|---|
| 3 | 13 | |
| 418 | 8,904 | |
| 0.5% | 0.5% | |
| 9.0 | 5.9 | |
| 7 days ago | 16 days ago | |
| Go | Shell | |
| Apache License 2.0 | Apache License 2.0 |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
connaisseur
Posts with mentions or reviews of connaisseur.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2021-11-16.
-
Container security best practices: Comprehensive guide
We already mentioned Connaisseur Admission Controller as a way to enforce content trust and reject images that are not signed by trusted sources.
- GitHub - sse-secure-systems/connaisseur: An admission controller that integrates Container Image Signature Verification into a Kubernetes cluster
-
Making the Internet more secure one signed container at a time
Admission Controller was based on Connaisseur, heavily modified to work with v2 instead of v1 signatures.
docker-bench-security
Posts with mentions or reviews of docker-bench-security.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-07-21.
-
Understanding Container Security
Scanning your container images for vulnerabilities is a good approach. But this scanning is not one time job, it should be done regularly (weekly, monthly, etc.) You need to follow vulnerability reports and fix all of the vulnerabilities as soon as possible. I recommend some open-source tools that could be useful: Trivy, Docker-Bench, Grype.
-
Security docker app
For Docker configuration I have used this in the past (it utilizes the CIS Docker Benchmark): https://github.com/docker/docker-bench-security
- What's your favourite Docker Image, and why?
-
Docker image scan against cis benchmark
So the main tool to scan against the CIS Docker benchmark (I'm presuming that's the one you're interested in) is https://github.com/docker/docker-bench-security .
-
How to enhance container security using Docker Bench
git clone https://github.com/docker/docker-bench-security.git cd docker-bench-security sudo sh docker-bench-security.sh
-
Importing certificates into containers
when deploying images on cloud, I always run it thru "docker bench security" It helps finding potential security holes in my images.
-
How to Secure Your Kubernetes Clusters With Best Practices
Use Docker Bench for Security to audit your container images
-
Container security best practices: Comprehensive guide
Other tools you can use are linux-bench, docker-bench, kube-bench, kube-hunter, kube-striker, Cloud Custodian, OVAL, and OS Query.
- hardening my container: am i doing things right?
-
What do you have within your pipelines to ensure that containers deployed are secure?
I run https://github.com/docker/docker-bench-security against my environment. I would determine what was non-applicable/not scored and then start with scored. Then I would do not scored. My team had made their own Dockerfiles when I started and just grabbed whatever image/version and getting things baselined was not fun. I had to do this for docker-compose and stay on version 2 yml as otherwise I had to go to swarm.
What are some alternatives?
When comparing connaisseur and docker-bench-security you can also consider the following projects:
cosign - Code signing and transparency for containers and binaries
hadolint - Dockerfile linter, validate inline bash, written in Haskell
gatekeeper - 🐊 Gatekeeper - Policy Controller for Kubernetes
kube-bench - Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark
enhancements - Enhancements tracking repo for Kubernetes
checkov - Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
gatekeeper-library - 📚 The OPA Gatekeeper policy library
gosec - Go security checker
magtape - MagTape Policy-as-Code for Kubernetes
SonarQube - Continuous Inspection
cfn_nag - Linting tool for CloudFormation templates
tfsec - Security scanner for your Terraform code
connaisseur vs cosign
docker-bench-security vs hadolint
connaisseur vs gatekeeper
docker-bench-security vs kube-bench
connaisseur vs enhancements
docker-bench-security vs checkov
connaisseur vs gatekeeper-library
docker-bench-security vs gosec
connaisseur vs magtape
docker-bench-security vs SonarQube
connaisseur vs cfn_nag
docker-bench-security vs tfsec