The Rise of Docker and Containerization

Docker, an open-source platform that automates the deployment of applications in lightweight, portable containers, has impacted application development and deployment since its launch in 2013. Containers bundle an application with its dependencies, ensuring consistent operation across different environments. This addresses the common “it works on my machine” problem, making Docker an essential tool for developers and operations teams. Docker’s rise in popularity is due to its ability to simplify the deployment process, enhance scalability, and improve resource efficiency.

According to Gartner, by 2029, more than 95% of global organizations will be running containerized applications in production, which is a significant increase from less than 50% in 2023 (source: Sysdig 2023 Cloud-Native Security and Usage Report)

The Importance of Security in Containerization

Containers, by their very nature, package not just the application but also its dependencies, which can often include outdated or vulnerable software. Why does that matter? Vulnerable software can lead to a security breach, which could result in customer attrition, as clients might lose confidence in the company’s capacity to secure their information. Ensuring that these containers are free from vulnerabilities is critical to maintaining the integrity and security of the deployed applications. According to Red Hat, State of Kubernetes Security 2023 cloud-native technologies offer agility, faster time to market, and reliability. However, 67% of enterprises face deployment delays due to security concerns. Security incidents can lead to severe impacts, including employee terminations, fines, revenue loss, and eroded customer trust.

According to the same source, in the last 12 months, 66% of enterprises have experienced software supply chain security issues due to the usage of insecure container images
and ”more than 50% of respondents are worried about misconfigurations and vulnerabilities”
Recognizing these challenges, Checkmarx aims to meet developers where they are with our extension – Docker Desktop – which  empowers them to strengthen Docker image security posture early in the development lifecycle and adopt a proactive security approach.

What is Docker Desktop

With over 3.3 million installs, Docker Desktop is one of the most popular software platforms for developers. It allows them  to work locally on their workstations, and provides out-of-the-box containerization technology for building, running, and sharing applications.

This means that developers can build an application on one computer and then run it on another, without having to worry about installing all the dependencies that the application needs. This saves developers time and effort.

Checkmarx Docker Desktop Extension Overview

The Checkmarx Docker Desktop Extension is designed to enhance the security of your Docker images by proactively identifying and mitigating vulnerabilities. This extension integrates seamlessly with Docker Desktop, providing robust features such as comprehensive image scanning, package inspection, and vulnerability assessment.

Let’s dive deeper and understand how the Checkmarx Docker Desktop Extension works

Let’s begin with a common use case.

You want to ensure your container image’s security. In that case, you should utilize a container security engine to scan it for risks.

One you scan, you discover 632 vulnerabilities. Next, you must investigate them, assess their severities, and prioritize fixes accordingly.

Alternatively, opting for a more secure base image earlier in your development cycle can reduce vulnerabilities and risks. This is where Checkmarx Docker Desktop Extension comes in.

By seamlessly integrating this capability into Docker Desktop, developers can proactively identify and mitigate security issues much earlier, significantly reducing the risk of exposure in production environments.

Once you have assessed the security posture of the image you intend to use, based on the tool recommendation, you can continue to use it or select a different base image with a stronger security posture. In our example, you can see a decrease from 591 vulnerabilities to just two.

The extension uses Checkmarx’ proprietary database and  provides insights and recommendations to protect images from security risks, preserving the integrity of your containerized environments.

The key capabilities of the Checkmarx Docker Desktop Extension include:

1. Free Tool: No cost to use, with additional premium features coming soon.
2. No Checkmarx Account Required: Accessible without needing to sign up.
3. Image Scanning: Scan local images to obtain a detailed breakdown of image layers and identify security risks associated with dependencies
4. Package Inspection: Inspect packages within Docker images to ensure compliance with security best practices (package version, license,…)
5. Vulnerability Assessment: Identify vulnerabilities associated with packages within Docker images. You will find a detailed description of the CVE and its severity.
6. Recommendations and Remediation (Premium Feature): Receive suggestions for fixing vulnerabilities (coming soon).

The Checkmarx Docker Desktop Extension is a significant advancement in container security, empowering developers to strengthen their Docker images and align with industry best practices. With the integration of security into the development workflow, our extension enables developers to build and deploy secure containerized applications with confidence.

The Checkmarx Docker Desktop Extension is an important tool for developers and DevOps  professionals. By providing detailed insights into vulnerabilities along with offering robust scanning and inspection features, this extension helps maintain the integrity and security of containerized environments.

Install Checkmarx Docker Desktop Extension: Link to download.
You can find the detailed documentation here.