A container image is an unchangeable, executable package of software that stands alone. It consists of code, system tools, and system libraries that are used to run an application. When your container image is insecure, it is at risk of getting compromised. A compromised image will lead to the distribution of malware to anyone who gets access to your image.
The good news is that it isn’t too difficult to secure your container images if you’re making use of the right tools. Notary and The Update Framework (TUF) are open-source projects you can use to secure container images. In this article, we’ll show you how Notary and TUF work together to secure your container images.
Notary and The Update Framework: What Are They?
A problem surrounding container-based systems is to always make sure your images are authentic. This is to avoid downloading a misconfigured or malicious image. Docker introduces a feature known as “content trust” that helps solve this problem.
Content trust allows you to sign container images and push them to a registry. It also allows you to verify that these images are where you want them to be. Notary is an image-signing tool that allows you to carry out the process.
The Update Framework (TUF) is an open-source application designed to secure software update systems. TUF focuses on using roles and keys to help maintain security. It also provides an option for recovery when the security gets compromised. The goals of TUF are simple, and it includes:
- Giving users access to a framework they can use to secure update systems.
- To provide several means to reduce the risk of attacks or key compromises.
- To provide a flexible system that a variety of software update systems can put in place.
Notary is a tool built on TUF that helps to provide trust over a variety of container images. It does so by performing the signing of an image using TUF’s roles and Keys. So, Notary works by using TUF as the underlying security framework. Both Notary and TUF are projects added to the Cloud Native Computing Foundation.
Securing Container Images With Notary and TUF
You get more comprehensive security for container images when you use Notary and TUF. The ability for Notary to work with TUF gives a better sense of confidence in the integrity of your container images. Notary authenticates a container image by signing them. While TUF verifies your download to make sure that you are pulling out what you are expecting.
Roles of Notary:
The main function of Notary is to provide authenticity and integrity to container images. But what are the specific roles that Notary play to provide this authenticity? Let’s have a look:
- Image Signing: Notary allows you to sign a container image using secure keys. It plays its role by adding a digital signature which you can use to verify the authenticity of the image. Thereby making it difficult to substitute a signed image for a compromised one.
- Publishing of Images: After signing an image using Notary, you can now push it to a registry like Docker Hub. The registry is where images are stored and accessed by other users. This registry now becomes a central repository for accessing your container images.
- Notary Server: Notary operates with a server that stores information like the metadata of images after they are created. It maintains a transparency log that records the signing and publishing process of a container image.
Notary secures a container image by playing the roles listed above. It encrypts an image by pushing a signed manifest to the Notary server. This encryption helps to mitigate many container images related risks.
Roles of TUF:
Asides from providing keys for Notary to secure a container image, TUF also plays a few more roles. TUF verifies the sources of container images and also encrypts their contents. TUF stores information of signed metadata which includes:
- Signing keys
- Image hash
- Key rotation schedules
You can use the above-stored information to verify the container images by:
- Downloading the signed metadata
- Cross-checking to see if the metadata are signed
- Verifying if the image hash found in the metadata matches the expected image
- Ensuring that the keys used in signing are trusted according to TUF specifications
When an image ticks all the lists above, then you can rest assured that the image is authentic. Here are the specific roles played by TUF in securing container images:
- Rollbacks and Recovery: TUF allows you to roll back to a prior good state. This is in case your container images get compromised. Rollback saves the stress of building a container image from scratch after an attack.
- Key Rotation: TUF allows for a regular replacement of keys used in signing images. This key rotation prevents complications from specific keys being compromised.
- Metadata Consistency: TUF makes sure that the metadata is up-to-date and consistent. All updates to a container image are recorded and stored. The consistency of metadata further strengthens the integrity of container images.
TUF proves to be a robust security framework with all its roles. The recording of updates and the option for rollbacks make TUF a versatile tool. In the next section, we’ll dive into the steps you can take to sign and secure your images using Notary and TUF.
How Do You Sign a Container Image in Docker Using Notary and TUF?
To get started, you need to configure Notary and its server with the support of TUF. After the configuration, here’s a quick preview of what you need to do:
- Initialize Notary with TUF:
You will need to initialize Notary and TUF for your Docker repository:
#initializing Notary with TUF
notary -s https://<tuf-server>/v2 init --trust-dir <trust-directory> <registry>/<repository>Replace <trust-directory> with the directory where you will store the metadata of Notary.
- Add Signing Key:
Here, you will need to generate a key. Replace <key-name> in the snippet below with what you will like to name your key:
#generating signing key
notary key generate <key-name>- Sign the Container Image:
You will use both Notary and TUF to sign the image:
#signing the container image with Notary and TUF
notary -s https://<tuf-server>/v2 sign <registry>/<repository>:<tag> --<key> <key-name>You will need to replace <registry>/<repository>:<tag> and <key-name> .
- Push the Signed Image:
After signing your container image, you will then need to push it to the registry:
#pushing the signed image
docker push <registry>/<repository>:<tag> If you do not have Notary app installed or do not know how to set up a TUF server, here is what you need to do:
- Installing Notary:
You will need to make use of Docker to install Notary. To do this, run the following command below in Docker:
#installing notary
docker pull docker/notary- Setting Up the
<tuf-server>:
<tuf-server>‘s are usually implemented by individual organizations to help secure their software distribution. This means there aren’t any specific public <tuf-server>‘s available. Instead, you will have to set up the <tuf-server> yourself. To do this, you can follow the TUF python reference implementation on github.
Here are the general steps you will have to follow:
- Choose a TUF library in your preferred language. The TUF reference implementation above is written in python.
- Install the choosen TUF library using the package manager for your programming language. For python, you can use pip:
pip install TUF- Use the choosen library to set up a TUF server
- Configure TUF roles like “Targets”, “Snapshots”, “Roots”, and “Timestamp”
- Implement secure storage to store cryptographic keys used to sign metadata
- Integrate with your software distribution
- Test and monitor the
<tuf-server>implementation
For a more detailed process, we recommend you refer to the official documentation on github using the link above.
Benefits of Securing Container Images with Notary and TUF
Notary and TUF come with a lot of benefits. These benefits include integrity, trust, and authenticity. Here are the primary benefits of securing container images with Notary and TUF:
- Ensuring Trust within Container Images: The verification processes of Notary and TUF guard against unauthorized modifications, tampering, and chain attacks. Digital signatures and encryptions help to achieve this trust.
- Guard Against Malicious or Compromised Images: Notary and TUF help to guard against the distribution of malicious images. You can verify the authenticity of a container image before pulling it out. This guard helps to reduce the risk of pulling out a malicious image.
- Support for Several Trust Models: Notary and TUF support a variety of trust models. To better meet a wide range of use cases, Notary and TUF allow for the establishment of decentralized trust models. The decentralized trust model distributes trust among several entities. This distribution reduces dependence on a central authority, reducing an attack’s damage. There is an increase in transparency, resilience, and accountability in decentralized trust models.
- Open-source: All open-source projects give you access to an active community. This community is where you can collaborate with peers, review and improve projects. Notary and TUF give you access to the expertise and contributions of a community. It gives you the reassurance that Notary and TUF are accessible and evolving to meet users’ needs.
Challenges of Notary and TUF
Notary and TUF come with a long list of benefits, but it also comes with a few challenges. These challenges usually range between the implementation and usage of Notary and TUF. Here are a few challenges you need to know:
- Complex Implementation: Setting up Notary and TUF to secure container images can get quite complicated. Setting up trust servers, management of keys, and maintenance of metadata is complex. Notary and TUF also make use of a few encryption protocols that may need a bit of expertise to grasp. Rugged is a server side implemenation of a TUF server.
- Maintainace Overhead: Notary and TUF require active maintenance which includes updates to security patches, cryptographic libraries and protocol changess. If this maintenance is not carried out to keep the system up-to-date, it will introduce vulnerabilities.
- Limited Supply for Containers Outside Docker: A variety of container technologies can adopt Notary. But it has a limit in performance compared to being used by Docker. This limitation is because Notary is a tool designed to work with Docker and its images. If you plan on using container technology other than docker, you will have to work around this.
You should invest in the correct infrastructure if you plan to adopt Notary and TUF. Learning about the encryption protocols of both tools can also put you on the right path. The correct infrastructure and knowledge of Notary and TUF should make everything easier.
Conclusion
Notary and TUF give a powerful means to mitigate complications on container images. In this article, we have explained the roles of Notary and TUF. How they work together to sign, verify and authenticate your container images.
We have also taken a look at the benefits of Notary and TUF. Some of these benefits include support for trust models, and being open source. We have also taken a look at their challenges from their limited support of containers outside docker to their complexity.
Securing container images is a process that is gaining acceptance and evolving. It is important to stay up-to-date with the latest security updates on Notary and TUF. You can do this by staying in contact with the open-source community.
