Open Source Leadership Summit 2018

You've converted your service infrastructure into microservices running in containers, ready to be deployed to the cloud. To meet your software compliance obligations, you analyze some of the images to find all the packages installed and you realized that some of them are unrecognizable or shouldn't even be there. How did they get in there? You now realize that you will have to do this exercise for all of the containers you have created and may even have to redo some or most of your containerizing work. How will you accomplish this?

In this talk, Nisha Kumar will discuss some best practices on how to build compliant containers from the ground up, how Tern, an open source project, attempts to extract package metadata from an existing container, and how the container distribution ecosystem can improve for the benefit of everyone working with containers.