Explore the intricate process of Atmosphere's secure image building in this technical deep dive. Understand the role of Docker Content Trust, Trivy, and Cosign in enhancing security across the stack, ensuring the reliability and integrity of images. Discover how Atmosphere addresses unpatched security issues, verifies image signatures, and maintains continuous security through daily scans.
Atmosphere is at the forefront of the cloud computing landscape, employing innovative technologies and processes to ensure the integrity and security of its virtual environment. This technical deep dive focuses on the use of the vexxhost/docker-openstack-builder image, illustrating how Atmosphere builds the virtual environment with all the OpenStack Python packages.
Docker Content Trust
The vexxhost/docker-openstack-builder image is built as a base of either Ubuntu Focal (for older releases) or Ubuntu Focal (for the newer releases). The key element here is the enforcement of Docker Content Trust when pulling down these base images. This enforcement ensures that the images are signed, verifying their authenticity and integrity, thereby enhancing the overall trust in the images used.
```yaml
- uses: docker/build-push-action@v5
...
env:
DOCKER_CONTENT_TRUST: 1
with:
sbom: true
...
```
You can see the rest of the workflow here. You'll also notice that we generate an software bill of materials (SBOM) for the image, which is a great way to track all of the dependencies that are used in the image.
Security Issues
To further fortify the security, we implement a list of modifications to the upper-constraints.txt file. This file is used by OpenStack to pin all dependencies during testing, however they often contain many unpatched CVEs. These changes address all unpatched security issues, ensuring potential vulnerabilities are identified and patched, reducing the risk of security breaches.
```
2023.1 security updates
sed -i s/^cryptography===38.0.2/cryptography===41.0.4/ /upper-constraints.txt
sed -i s/^Django===3.2.16/Django===3.2.22/ /upper-constraints.txt
sed -i s/^pyOpenSSL===22.1.0/pyOpenSSL===23.2.0/ /upper-constraints.txtsed -i s/^requests===2.28.1/requests===2.31.0/ /upper-constraints.txtsed -i s/^sqlparse===0.4.3/sqlparse===0.4.4/ /upper-constraints.txtsed -i s/^urllib3===1.26.12/urllib3===1.26.18/ /upper-constraints.txt```
