Java Language & PlatformLunch Talk40min
Mission Possible: The 45-Minute Path to Bullet-Proof Java Container Images
A lunch session on hardening Java container images by reducing CVE noise and operational risk. It covers choosing minimal base images, shrinking privileges, pinning versions, signing and SBOMs, using CVSS-based scanning, and automating updates with Dependabot/Renovate, with practical Dockerfile guidance and verification steps.
talk.summaryAiDisclaimer
Pasha FinkelshteinBellsoft
talkDetail.whenAndWhere
Wednesday, October 7, 13:05-13:45
TBA 2
talks.roomOccupancytalks.noOccupancyInfo
Your mission is to turn a bloated CVE-infested container image into a low-noise image with low vulnerability exposure and clear operational posture. You have 45 minutes before the explosive attack hits. Mission possible! This session provides a straight path towards building more secure and maintainable Java container images. We will identify the key culprits such as stale dependencies, outdated base, lack of provenance, and excessive privileges. Then, we will draft a step-by-step plan to:
Expect a before/after scan comparison, copy-and-paste Dockerfile instructions, verification checklist, and a clear and reproducible path towards hardened Java container images that provide an impenetrable lock-box for your applications.
- Pick a minimal and well-maintained base image,
- Shrink privileges,
- Prove provenance with version pinning, signatures and SBOMs,
- Scan and classify with CVSS rules to cut noise and fix what’s exploitable,
- Automatically monitor for updates with Dependabot/Renovate.
Expect a before/after scan comparison, copy-and-paste Dockerfile instructions, verification checklist, and a clear and reproducible path towards hardened Java container images that provide an impenetrable lock-box for your applications.
Pasha Finkelshtein
Years of experience in software engineering and the team's leading roles combined with his passion for Java made Pasha know all the hidden details in this IT niche. As a Developer Advocate for @Bellsoft, he educates the public on the latest software tools built by BellSoft and helps to create and test instruments for developers. He writes in Kotlin, speaks at conferences, composes a new articles, or maintains his pet projects.