Docker is launching an opt-in, security scanning service of the software included in container images.
Specifically, Docker Security Scanning enables detailed image security profiles, continuous vulnerability monitoring and notifications for integrated content security. The company said it will provide binary level scanning, generating a detailed security profile for each Docker image, including details that allow IT operations to assess if the software meets its security compliance standards. The service works seamlessly with existing dev and IT workflows and scans every time a change is shipped, adding a checkpoint before deployment. Docker Security Scanning works across any application and across all major Linux distributions which allow for integration into a Containers as a Service (CaaS) workflow that improves an organization’s security posture through central IT managed secure content.
“We’ve made it our goal to secure the global software supply chain from development, test to production,” said Nathan McCauley, Director of Security at Docker. “As with all of Docker’s tooling, Docker Security Scanning works as an integrated component without any disruption to developer productivity. In fact, Docker Security Scanning enables developers to accelerate their workflows while providing greater visibility into the Docker images they choose to run in their environment. In turn, with usable security capabilities and granular control, IT operations is able to flexibly configure the security policies needed to safeguard their infrastructure.”
