Red Hat OCID and Container Security
Date and Time
Wednesday, January 18, 2017 from 6:30 pm to 9:00 pm
Location
MIT Building E-51, Room 315
Presenters
Daniel J Walsh , Lead SELinux Engineer , Red Hat Software - dwalsh redhat com
Summary
Red Hat's new OCID container system, an alternative to Docker
Abstract
OCID (CRI-O) is a container runtime to be used with the Kubernetes Kublet. Specifically, it implements the Kubelet Container Runtime Interface (CRI) using OCI conformant runtimes. The goal of the OCID is to optimize running of containers in production, via Kubernetes and OpenShift.
At a high level, we expect the scope of OCID:
- Support multiple image formats including the existing Docker image format
- Support for multiple means to download images including trust & image verification
- Container image management (managing image layers, overlay filesystems, etc)
- Container process lifecycle management
- Monitoring and logging required to satisfy the CRI
- Resource isolation as required by the CRI
Second part of the talk will cover Container Security. We will cover all parts of container security from the importance of the kernel, to where you should run your containers, container separation and what you should run inside
Meeting Notes
Attachments
