Securing containers before they ship

0:00 at welcome to the show. Super excited to be here at CubeCon 2026. And for people that don’t know, Kat, what you doing for a living?

0:08 Uh, I am the head of developer advocacy at Minimus, a hardened container images company, but I am also an elected member of the Kubernetes steering committee, a technical lead for SIG docs, also within Kubernetes, and the owner of the Kubernetes release team sub project.

0:25 Wow, you sound super busy. It’s the the definitely the busiest event of the year for me. There’s a lot of my actual job to do and a lot of my community job to do. Yeah.

0:36 Tell me about it. And security is a big topic big concern for a lot of organ organization and how do you see this evolving?

0:45 Um I think people need to start considering open source projects to be like part of their security posture uh and maintaining those opensource projects to be part of their security posture. Um this year we’re shutting down ingress engine X. It was archived on stage yesterday and at the time uh a little bit less than 50% of cloudnative environments were still using it and since we are now no longer releasing it, no longer patching CVEes for it, every one of those installations is now in active danger. And that’s a result of the project not being maintained. It’s it’s a result of twoish years of pleas from the maintainers being ignored from the companies that are relying on it. Um

1:31 so we’ve landed oursel in a situation where quite a lot of clusters are now exploitable or will be as soon as somebody drops a vulnerability for ingress engine X and that situation was avoidable.

1:44 I can see I I know a lot of companies that have a production cluster that is running And I think one of the problem is upgrade path

1:54 because there is not like a drop in replacement of this type of component. You need to kind of do some rearchite texture or maybe your version Kubernetes is not up to date. So

2:04 your version of Kubernetes should always be up to date. You should never be using um an endof life version of Kubernetes. But I understand that some enterprises move slowly and it’s unavoidable for them. Uh yeah, there is no drop in replacement for ingress engine X at all. the the recommended option is to migrate to gateway API which can be a significant number of work amount of work. It really depends on how complicated how much uh you are taking advantage of the flexibility of ingress engine X then migrating to gateway API can be very hard but there are other ingress controllers you can use that are closer to a drop-in replacement. However, we we started warning we officially warned about this six months ago and the writing was on the wall two years ago. So this should not be a

2:50 surprise to anyone and everyone has had time to migrate. So at this at this point still being on it is a choice a deliberate choice to put yourself in danger in my opinion.

3:00 Fair enough. And there are wonderful vendor they take uh take care of the people that uh they would love to have like out of the box solution. I’m thinking on top of my head like that that they have a ingress operator and they have solution in place already.

3:15 Yeah. like everybody and their mother has like some kind of ingress solution that you can switch to. Uh the Kubernetes documentation has a list of I think like 20 of them. Um every hyperscaler has some kind of option but um using a hyperscaler version of Kubernetes does not necessarily mean that you weren’t using ingress engine X2. There’s nothing to stop you from using ingress engine X on like AWS or whatever. So you do have to like proactively check to see whether you’re using that or you’re using a third party ingress controller.

3:47 Cool. Thank you very much. But I think the biggest uh topic you mention is how to run secure image in production activity and I think this uh this came probably from supply chain uh uh control organization need to take have a good visibility connected probably with sbomb.

4:10 Yeah. So, Minimus provides um a hardened container image that in most cases around like a 97 to 98% reduction in CVEes. So, if you need um like an engine X base image, you use ours instead of the public version of the EngineX base image and I think ours has um currently zero CVES in it. It depends on whether or not a patch actually exists upstream for the image, but um you build off of our base image instead. And every time one of these open source projects issues a patch for a CVE, we automatically rebuild and redistribute it to you. Um, the SLA for that is like 48 hours. It’s lightning fast.

4:52 So, usually it’s quicker than that, but the official SLA is 48 hours.

4:55 You guys are fast.

4:57 We are very, very fast. And if you need more than engine X in your base image, you can use our image creator to build your own custom thing. And same deal every time one of those packages updates upstream. we will rebuild.

5:09 Oh, okay. So, it’s

5:10 Yeah, it’s a it’s a constant rolling thing

5:12 because one of the problem is that yes, I just build my image, but it’s not a one-off. If one of the underlying dependency of one of the libraries change,

5:21 yeah, if one of the libraries changes, we we rebuild and the next time you pull, you’re getting the the most recent one. You can you can set up some integrations with uh with CI or even with Slack or um Jira or whatever to like warn you every time there’s a rebuild or every time a CVE drops. There’s all kinds of like no code ways to write these integration workflows to automate as much of it as possible to a point where you don’t really have to think of it much after implementation which is pretty rad. Yeah, this is this is very interesting because I’m working a lot with enterp enterprise customer that they have probably in the internal custom CA

5:57 with all the internal certificate and one this is

6:01 an additional CA that I need to add to every image. Yeah.

6:05 So in all the domain so it become a burden managing image.

6:09 Yeah. Another challenge that they see is that uh by the regulation the duration certificate certificate that we issue

6:18 is getting shorter and shorter.

6:20 Yeah.

6:20 From uh few years ago I I saw organization having like 10 years uh certificate

6:26 and now the usage it will be reduced till managing one uh up to one month.

6:33 Yeah.

6:34 It can be really really narrow for sure. We we take a lot of that out of your hands. Like there there’s a lot you don’t have to worry about anymore. Um we have FIPS fully FIPS and STIG compliant images too. Um we support air gapping so you can use a private registry and fully air gap everything. Uh which is great for like fed ramp applications and whatnot. Um the images do get certified. They it it really is a lot that you no longer have to worry about. We provide signed sbombs. there’s an entire threat intelligence dashboard built into it. So when there are CVEs that are unpatched in uh some upstream project, you get a ranked list by exploitability of what’s left. So you know where you have to be like a little bit more cautious.

7:21 We we don’t want um we don’t want security to be a thing that’s hard for people to implement correctly, you know.

7:29 Yeah. What I’m hearing from my community, especially with CEO, is that uh the security team is overloaded by request.

7:39 Oh, badly. Yeah,

7:41 they are.

7:41 Unfortunately, the team is more or less the same people that managed the infrastructure a few years ago. But the amount of thread, the amount of things around are boom.

7:52 Yeah. So, how do you see the future?