Using Satellite as container repository
Hello!
We're looking to dip our toes into the world of containers before vendors start sending ONLY containerized apps. Some of the containerized apps require access to docker.io or some such site to download new/updated containers. Our infrastructure is locked down and only a few (can count 'em on one hand!) hosts can access the Internet. I've got Satellite up and running fine, serving yum repos for RHEL and OEL, so that's good. I'd like to have something similar for containers so that we can configure the hosts to access containers from the Satellite server.
BUT...
We would like to have those containers security checked before we release them to the repo for use. Is this something that Satellite can help with? Like maybe a hook for Jenkins or other CI/CD app?
Any info is much appreciated.
Thanks in advance!
Mike
Responses
Guru
22286 points
Hi Michael,
- Scanning docker images is discussed at this link to some degree
- Also, this article has a quite a number of sources for container security
This Red Hat article seems to potentially address your question somewhat at https://access.redhat.com/solutions/3233491. I do not see any discussion regarding security checks. I'm personally surprised this Red Hat solution exists, considering the rpms and dependencies for Satellite and Docker, you could potentially run into issues with updates maybe/maybe not. Since this Red Hat Article exists, it seems to be supported, regardless of my own seemingly unwarranted personal concerns of having this on Satellite. However, I am not clear if it has security checking involved.
I get the idea that you might possibly want a "Docker Registry". This Digital Ocean article for another OS gives a description of a Docker Registry:
Docker Registry is an application that manages storing and delivering Docker container images. Registries centralize container images and reduce build times for developers. ... Docker of course has a free public registry at Docker Hub, but there are situations where you will not want your image to be publicly available.
- Red Hat has that solution I mentioned above. However, I'd recommend opening a Red Hat case if you go down this path and cite the article at https://access.redhat.com/solutions/3233491
- For reference, the Docker folks have some info on creating docker registry at this link.
- Also for reference, This link here is for CentOS 7.
Regards,
RJ