Question

A development team ships microservices as Docker containers built from public base images pulled at build time. The security team wants to embed a control in the CI/CD pipeline that prevents containers with known critical OS-level vulnerabilities in their base layers from ever being promoted to production. Which SecDevOps recommendation best addresses this requirement?

Accepted Answer

Integrate an automated container image vulnerability scanner into the build stage that fails the pipeline when critical CVEs are detected in the image layers

Answer

Schedule a monthly authenticated vulnerability scan of running production containers and open remediation tickets for findings

Answer

Require developers to manually review the base image changelog before committing their Dockerfile

Answer

Deploy a host-based IDS on the container hosts to alert when a vulnerable process executes