July 2018 Summaries

This blog post by Michael Ducy describes how he used Docker and Visual Studio Code to simplify setting up a programming environment for his son, who wanted to learn to code using Minecraft. Initially, they faced challenges with the book "Learn to Program with Minecraft" due to complexities in installing the necessary software like Python 3.6 and Spigot on a Mac, which led to debugging issues and conflicts with the local system's Python version. To address these, Ducy leveraged Docker to create a more manageable and resettable development environment, allowing them to run both the Minecraft server and the Python environment within containers. This approach made it easier to install and manage necessary tools, such as the py3minepi library and the RaspberryJuice plugin, without altering the local system significantly. The setup involved creating Docker containers for both the server and development environment, using Docker Compose for efficient and repeatable server management, and adapting scripts to connect to the Dockerized Minecraft server. Ducy highlights the ease and flexibility Docker provides in creating disposable development environments, allowing his son to learn programming in a more streamlined and problem-free manner.

Container security is crucial for organizations using Docker and Kubernetes, and this guide provides a detailed approach to implementing an open-source container security stack. The process involves multiple steps from development to production, including implementing Docker security best practices and securing the infrastructure layer. A key component is runtime security, using tools like Sysdig Falco to monitor container behavior and detect anomalies by evaluating real-time system call events and Kubernetes metadata. Falco's ruleset library helps define security policies, while NATS and Kubeless facilitate incident response through automated security playbooks. These playbooks can perform actions such as sending notifications, deleting offending pods, or isolating pods from the network, depending on the security event. Additionally, integrating logging tools like Fluentd with Falco ensures long-term event storage for analysis. The guide emphasizes automation and modularity, using open-source tools to tailor the security stack to specific organizational needs, and highlights the importance of fast incident response due to the ephemeral nature of containers.

Sysdig Falco is an open-source tool designed for implementing run-time security in Kubernetes clusters, and it can be deployed efficiently using Helm charts, the Kubernetes package manager. By packaging Falco as a Helm chart, users can easily install it with a simple command if they already have Helm set up, streamlining the process of deploying security rules in their Kubernetes environments. The Falco Helm chart offers extensive configuration options, allowing users to customize settings through command flags or a values.yaml file for more portable deployment scripts. Additionally, the tool includes a Falco Event Generator for testing setups by simulating anomalous activities, and Kubernetes ConfigMaps can be leveraged to apply custom security rulesets for specific container images. For those preferring enterprise-level features and support, Sysdig also offers a commercial platform called Sysdig Secure, providing enhanced capabilities for container security, vulnerability management, compliance, and forensics.