This week, Docker announced the general availability of Docker Security Scanning, a service that enables Docker Cloud private repo customers to perform security assessments of software in containers as an opt-in service. Docker Security Scanning evaluates the security of Docker images subsequent to their upload to the Docker Cloud and thereupon performs continuous monitoring of image security in conjunction with updates to the Continuous Vulnerability and Exposure database. The security scan delivers a Bill of Materials featuring a security profile of constituent components of a Docker image that empowers Independent Software Vendors (ISVs) to modify their content in the event of the detection of a security vulnerability. In addition, Docker’s security scanning service sends out automated notifications that enable IT teams to proactively manage risks associated with security vulnerabilities. By performing binary level scanning that assesses the security of every component of code housed within a container, Docker Security Scanning streamlines and simplifies the achievement of software security within a container-based environment for building, shipping and deploying code. Moreover, the platform allows users to remove compromised containers and thereby improve governance and control over software development that leverages a container framework. With the release in GA of Docker Security Scanning, Docker’s strengthens its position as the de facto infrastructure for building, shipping, deploying and managing updates to code. The service is available to all Docker Cloud private repo customers immediately and is expected to expand to all Docker Cloud customers by the end of Q3.
Cloud Computing Today 