Buoyed by the recent Snyk security report that found security vulnerabilities in several container images except Ubuntu’s, the company behind it, Canonical, has published a whole portfolio of hardened images.
Unsurprisingly, Canonical has partnered with Docker to streamline the delivery of the secure portfolio of images through Docker Hub.
“Canonical and Docker will partner together to ensure that hardened free and commercial Ubuntu images will be available to all developer software supply chains for multi-cloud app development,” Docker's Matt Carter wrote in a blog post announcing the collaboration.
- We've put together a list of the best DevOps tools available
- These are the best laptops for programming on the market
- Also check out the best mobile app development software
Long term security
The 2020 Snyk State of Open Source Security report discovered security vulnerabilities in several popular container images, while giving a clean chit to Canonical’s Ubuntu image.
The company builds on this achievement and in a FAQ posted on its new repository, promises to fix any Common Vulnerabilities and Exposures (CVEs) within 24 hours of being reported.
Canonical’s LTS portfolio will include both free and commercial images and already lists about a dozen images for prominent open source software including Redis, Nginx, Grafana, Prometheus, and several others.
All of the hardened images in the repository will have a five-year free security maintenance period, same as the underlying Ubuntu LTS release they’re based on. Paying customers of Canonical’s Ubuntu Pro program will get an additional five years of support as part of the ten year Extended Security Maintenance contract.
Canonical’s announcement is the second major security-related initiative by Docker in as many months. Just last month application security company Snyk announced that they’ve started providing security scanning capabilities for images pushed to Docker Hub.
Canonical hopes the two developments will help “drive a surge in Kubernetes adoption as companies embrace digital transformation while significantly reducing operating risk in the solution application life-cycle.”
- Subscribe to Linux Format magazine for more Linux and open source goodness
