technologyApr 19, 201825:45pending
The Cloudcast #343 - Container Vulnerability Scanning
About this episode
Aaron and Tyler Britten talk with Liz Rice (@lizrice, Technology Evangelist @AquaSecTeam) about what's easy—and what's not—about finding and patching security vulnerabilities in containers. This is a cross-over show with @PodCTL podcast.
Show Links:
Show Links:
- Liz’s talk at Velocity Conf - “What’s so hard about container vulnerability scanning?”
- Use code "CLOUD" to get 20% off Velocity and OSCON Conference Passes
- Aqua Security Homepage
- Liz Rice’s Blog
- [Video] Kubernetes, Metadata and You (KubeCon 2017 Austin)
- [PODCAST] @PodCTL - Containers | Kubernetes | OpenShift - RSS Feed, iTunes, Google Play, Stitcher, TuneIn and all your favorite podcast players
- [A CLOUD GURU] Get The Cloudcast Alexa Skill
- [A CLOUD GURU] A Cloud Guru Membership - Start your free trial. Unlimited access to the best cloud training and new series to keep you up-to-date on all things AWS.
- [A CLOUD GURU] FREE access to AWS Certification Exam Prep Guide - At A Cloud Guru, the #1 question received from students is "I want to pass the AWS cert exam, so where do I start?" This course is your answer.
- [FREE] eBook from O'Reilly
Show Notes
Feedback?- Topic 1 - Welcome to the show Liz. Tell us a little bit about your background and the types of things that you’re working on these days.
- Topic 2 - Let’s start with the basics. A container is defined by a file (e.g. Dockerfile) that the user/developer/operator defines. How can a vulnerability get into that file?
- Topic 3 - Is it up to the CI/CD system or host OS (where the container runs) or container orchestrator (e.g. Kubernetes) or container registry to figure out if a vulnerability exists?
- Topic 4 - How do most container registries today manage vulnerability lists, container scanning and potential mitigations? What are the difficult parts of those tasks?
- Topic 5 - Most containers today are Linux containers. Are you seeing anything happening (yet) around how to manage Windows containers vulnerabilities? Is the assumption that Microsoft will fix this through one of their existing tools, or are things happening in the open source community as well?
- Email: show at thecloudcast dot net
- Twitter: @thecloudcastnet and @ServerlessCast
FEEDBACK?
- Email: show @ the enterprise ai show dot com
- Bluesky: @TheEntAIShow.bsky.social
- Twitter/X: @TheEntAIShow
- Instagram: @TheEntAIShow
Get every episode summarized
Each time The Cloudcast publishes, we email you a written briefing from the transcript — the topics, who appeared, and any specific claims, with the ad reads skipped.
Email me new episodesFree for 3 shows. No card needed.
No transcript yet
This episode has not been transcribed. Request it and it moves to the front of the queue.
More episodes
More from The Cloudcast
How Open-Source is Reshaping the AI Infrastructure Stack
The Cloudcast
Sep 9, 202642:20pending
Vitamins vs. Pain Killers vs. Whippets - The Enterprise AI Adoption Problem
The Cloudcast
Sep 6, 202622:15pending
AI News of the Month - August 2026
The Cloudcast
Sep 2, 202638:30pending
AI Watermarking: Compliance Theater or Real Provenance Tool
The Cloudcast
Aug 30, 202617:30pending