Containerd Project Security Self-Assessment - Security Pals #1202

smallfoot47 · 2023-12-08T03:39:26Z

Containerd Project Self-Assessment

Nathan Smith
Sunny Li
Swati Baleri
Vivek Radhakrishnan

Created and added first draft for OpenMetrics Project Security Self-Assessment.
Please feel free to share your feedback on the security self-assessment.

netlify · 2023-12-08T03:39:32Z

✅ Deploy Preview for tag-security ready!

Name	Link
🔨 Latest commit	`1ed697b`
🔍 Latest deploy log	https://app.netlify.com/sites/tag-security/deploys/65baa00c78a187000803c8b8
😎 Deploy Preview	https://deploy-preview-1202--tag-security.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

eddie-knight · 2023-12-08T14:30:24Z

Hi there! I'm just starting to take a look at this, and I noticed that your pull request name isn't very descriptive.

If you take a look at the Pull Requests page, you'll see that the pile can be a lot easier to navigate if we all use descriptive titles. That'll help reviewers move more quickly, and also it's a great practice to follow when you're doing future work on platforms like GitHub/GitLab/Bitbucket/etc.

Instead of Group 27 self assessment a better alternative might be containerd self-assessment

eddie-knight · 2023-12-08T16:42:58Z

I also noticed the DCO check is failing.

You can look at the checks section of the PR (I believe it should always be below the last comment) and look for a red X highlighting the failed check. In this case, you can click Details for more information about how to get that check passing.

eddie-knight · 2023-12-08T16:44:45Z

Containerd/self-assessment.md

+The Self-assessment is the initial document for projects to begin thinking about the
+security of the project, determining gaps in their security, and preparing any security
+documentation for their users. This document is ideal for projects currently in the
+CNCF **sandbox** as well as projects that are looking to receive a joint assessment and
+currently in CNCF **incubation**.
+
+For a detailed guide with step-by-step discussion and examples, check out the free 
+Express Learning course provided by Linux Foundation Training & Certification: 
+[Security Assessments for Open Source Projects](https://training.linuxfoundation.org/express-learning/security-self-assessments-for-open-source-projects-lfel1005/).
+
+# Self-assessment outline


Please go back to ensure that no template text like this is included here or in the rest of the document

eddie-knight · 2023-12-08T16:45:01Z

Containerd/self-assessment.md

@@ -0,0 +1,350 @@
+# Self-assessment


Suggested change

# Self-assessment

# Containerd Self-assessment

eddie-knight · 2023-12-12T02:24:29Z

assessments/Open_and_Secure_Early_Access.pdf

It appears that something got wonky with the commit history here. Same with the _index.md file linked below. Please check your history and clean it up accordingly.

ragashreeshekar

Thanks for the PR @SassyQuatch47 and team, appreciate the efforts.
I have completed first pass of review and left a few comments on section that needs your attention. Please feel free to reach out here or on slack for any questions and clarifications.

ragashreeshekar · 2023-12-13T08:02:24Z

Containerd/self-assessment.md

+Role: Leverage containerd for deploying, managing, and orchestrating containerized applications.
+Interaction: Engage with containerd through various interfaces and tools, contributing to the widespread adoption and integration of containerized solutions.
+
+### Actions


This section talks about the various functions/benefits of this project however it is meant to showcase the individual parts of your system that interact to provide the desired functionality.
Ref: https://github.com/cncf/tag-security/blob/main/assessments/guide/self-assessment.md#actors

Please update this section to include the right actors.

ragashreeshekar · 2023-12-13T08:04:50Z

Containerd/self-assessment.md

+
+## Self-assessment use
+
+This self-assessment is created by the Containerd team to perform an internal analysis of the project's security.  It is not intended to provide a security audit of Containerd, or function as an independent assessment or attestation of Containerd's security health.


Can you please specify at the top which member of the maintainer team acted as an author on this? (Or otherwise rephrase)

ragashreeshekar · 2023-12-13T08:06:02Z

Containerd/self-assessment.md

+
+  https://azure.microsoft.com/en-us/updates/generally-available-containerd-support-for-windows-in-aks/
+
+* Related Projects / Vendors:


Please elaborate how these project/vendors relate to this project, and what the key differences between them are.

…f#1118) Bumps [postcss](https://github.com/postcss/postcss) to 8.4.31 and updates ancestor dependency [autoprefixer](https://github.com/postcss/autoprefixer). These dependencies need to be updated together. Updates `postcss` from 7.0.39 to 8.4.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@7.0.39...8.4.31) Updates `autoprefixer` from 9.5.0 to 10.4.16 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](postcss/autoprefixer@9.5.0...10.4.16) --- updated-dependencies: - dependency-name: postcss dependency-type: indirect - dependency-name: autoprefixer dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com> Co-authored-by: Vivek Radhakrishnan <vrk3366@nyu.edu> Co-authored-by: Swati Baleri <sb9156@nyu.edu> Co-authored-by: Sunny Li <sl9052@nyu.edu> Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

Signed-off-by: nomnomninja <150766910+nomnomninja@users.noreply.github.com> Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

Signed-off-by: Sunny Li <100388296+sunnnnyli@users.noreply.github.com>

sublimino · 2023-12-15T05:43:06Z

Containerd/self-assessment.md

+The Self-assessment is the initial document for projects to begin thinking about the
+security of the project, determining gaps in their security, and preparing any security
+documentation for their users. This document is ideal for projects currently in the
+CNCF **sandbox** as well as projects that are looking to receive a joint assessment and
+currently in CNCF **incubation**.
+
+# Self-assessment outline


This is superflous, see this example for what to remove

Suggested change

The Self-assessment is the initial document for projects to begin thinking about the

security of the project, determining gaps in their security, and preparing any security

documentation for their users. This document is ideal for projects currently in the

CNCF **sandbox** as well as projects that are looking to receive a joint assessment and

currently in CNCF **incubation**.

# Self-assessment outline

sublimino · 2023-12-15T05:43:20Z

Containerd/self-assessment.md

+
+## Metadata
+
+A table at the top for quick reference information, later used for indexing.


Suggested change

A table at the top for quick reference information, later used for indexing.

sublimino · 2023-12-15T05:43:34Z

Containerd/self-assessment.md

+Provide the list of links to existing security documentation for the project. You may
+use the table below as an example:


Suggested change

Provide the list of links to existing security documentation for the project. You may

use the table below as an example:

sublimino · 2023-12-15T05:45:46Z

Containerd/self-assessment.md

+
+## Overview
+
+Containerd is a Cloud Native Computing Foundation (CNCF) Project focused on providing the core functionalities for container orchestration. Specifically architected to focus on modularity and compatibility, this provides a secure and minimal approach making it a great option for integrating into different container systems. 


Suggested change

Containerd is a Cloud Native Computing Foundation (CNCF) Project focused on providing the core functionalities for container orchestration. Specifically architected to focus on modularity and compatibility, this provides a secure and minimal approach making it a great option for integrating into different container systems.

Containerd is a container runtime focused on providing the core functionalities for managing container lifecycles. Specifically architected to focus on modularity and compatibility, it provides a secure and minimal approach making it a great option for integrating into different container orchestrators.

sublimino · 2023-12-15T05:47:38Z

Containerd/self-assessment.md

+
+Containerd, a fundamental tool in the realm of containerization, provides a dependable and standardized approach to managing containers. It is a lightweight yet powerful container runtime, ensuring a consistent and efficient experience.
+
+Originally developed by Docker, Inc. as an integral part of the Docker project, Containerd has evolved with the dynamic container ecosystem. Docker's decision to separate container runtime functionality led to Containerd, an independent project dedicated to container management.


Suggested change

Originally developed by Docker, Inc. as an integral part of the Docker project, Containerd has evolved with the dynamic container ecosystem. Docker's decision to separate container runtime functionality led to Containerd, an independent project dedicated to container management.

Originally developed by Docker, Inc. as an integral part of the Docker project, containerd has evolved with the dynamic container ecosystem. Docker's decision to separate container runtime functionality from the runc project led to containerd, an independent project dedicated to container management.

sublimino · 2023-12-15T05:48:20Z

Containerd/self-assessment.md

+
+**- Compatibility:**
+
+Aligned with the Open Container Initiative (OCI) specifications, Containerd ensures compatibility with other runtimes and tools adhering to the OCI standard. This compatibility facilitates easy transitions between container runtimes supporting OCI.


Suggested change

Aligned with the Open Container Initiative (OCI) specifications, Containerd ensures compatibility with other runtimes and tools adhering to the OCI standard. This compatibility facilitates easy transitions between container runtimes supporting OCI.

Aligned with the Open Container Initiative (OCI) specifications, containerd ensures compatibility with other runtimes and tools adhering to the OCI standard. This compatibility facilitates easy transitions between container runtimes supporting OCI.

Ensure the correct name containerd is used everywhere that it's not starting a sentence. See https://www.docker.com/blog/what-is-containerd-runtime/ for an example

sublimino · 2023-12-15T05:49:19Z

Containerd/self-assessment.md

+
+**- Containerd Core:**
+
+Role: Serves as the core orchestration engine, managing the complete lifecycle of containers.


Suggested change

Role: Serves as the core orchestration engine, managing the complete lifecycle of containers.

Role: The core container orchestration engine, managing the complete container lifecycle.

sublimino · 2023-12-15T05:51:28Z

Containerd/self-assessment.md

+
+**- Image Registries:**
+
+Role: Acts as repositories for container images, collaborating with containerd in tasks such as image pulling, pushing, and managing metadata.


Suggested change

Role: Acts as repositories for container images, collaborating with containerd in tasks such as image pulling, pushing, and managing metadata.

Role: Repositories for container images, providing storage and retrieval for containerd in tasks such as image pulling, pushing, and metadata management.

sublimino · 2023-12-15T05:52:57Z

Containerd/self-assessment.md

+
+## Self-assessment use
+
+This self-assessment was authored by Swati Baleri, Vivek Radhakrishnan, Swati Baleri, Sunny Li, and Nathan Smith with a format established by the Containerd maintainers. The purpose of this document is to perform an internal analysis of the project's security.  It is not intended to provide a security audit of Containerd, or function as an independent assessment or attestation of Containerd's security health.


Suggested change

This self-assessment was authored by Swati Baleri, Vivek Radhakrishnan, Swati Baleri, Sunny Li, and Nathan Smith with a format established by the Containerd maintainers. The purpose of this document is to perform an internal analysis of the project's security. It is not intended to provide a security audit of Containerd, or function as an independent assessment or attestation of Containerd's security health.

This self-assessment was authored by Swati Baleri, Vivek Radhakrishnan, Sunny Li, and Nathan Smith with a format established by the Containerd maintainers. The purpose of this document is to perform an internal analysis of the project's security. It is not intended to provide a security audit of Containerd, or function as an independent assessment or attestation of Containerd's security health.

Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

torinvdb · 2024-01-16T18:55:32Z

Containerd/self-assessment.md

+# Containerd Self-assessment
+
+## Table of contents


Suggested change

# Containerd Self-assessment

## Table of contents

# Containerd Self-assessment

This assessment was created by community members as part of the [Security Pals](https://github.com/cncf/tag-security/issues/1102) process and is currently pending changes from the maintainer team.

## Table of contents

@ragashreeshekar

torinvdb · 2024-01-16T18:55:55Z

Containerd/self-assessment.md

+|   |  |
+| -- | -- |
+| Software | [containerd](https://github.com/containerd/containerd)  |
+| Security Provider | No  |
+| Languages | Go, C++ |
+| SBOM | [Packages](https://github.com/containerd/containerd/tree/main/pkg) [Versions](https://github.com/containerd/containerd/tree/main/version) |
+| | |


Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Raga <ragashreeshekar@gmail.com>

ragashreeshekar · 2024-01-30T17:28:25Z

@SassyQuatch47 Kindly address the pending suggestions. We (maintainers) do not have the permissions to update the PR hence we look forward to your updates. In the event it is not feasible, feel free to extend the permissions to us and we are happy to make the updates on your behalf. Thanks!

smallfoot47 · 2024-01-31T20:54:37Z

@SassyQuatch47 Kindly address the pending suggestions. We (maintainers) do not have the permissions to update the PR hence we look forward to your updates. In the event it is not feasible, feel free to extend the permissions to us and we are happy to make the updates on your behalf. Thanks!

Hi @ragashreeshekar , I apologize for the delay. We have given you permissions to update this PR. If any further issues come up, do let us know and we'd be happy to help!

github-actions bot requested review from mlieberman85, PushkarJ and ultrasaurus December 8, 2023 03:39

eddie-knight reviewed Dec 8, 2023

View reviewed changes

smallfoot47 changed the title ~~Group 27 Self Assessment~~ containerd self-assessment Dec 11, 2023

smallfoot47 changed the title ~~containerd self-assessment~~ Added Containerd Project Security Self-Assessment Dec 11, 2023

smallfoot47 changed the title ~~Added Containerd Project Security Self-Assessment~~ Containerd Project Security Self-Assessment Dec 11, 2023

smallfoot47 changed the title ~~Containerd Project Security Self-Assessment~~ Containerd Project Security Self-Assessment - Security Pals Dec 11, 2023

Nate-Smithline force-pushed the main branch from 7c7a72d to 8c9d4dd Compare December 11, 2023 21:05

eddie-knight reviewed Dec 12, 2023

View reviewed changes

Nate-Smithline force-pushed the main branch 2 times, most recently from bc4388e to 27c8e8a Compare December 12, 2023 23:21

ragashreeshekar requested changes Dec 13, 2023

View reviewed changes

Nate-Smithline approved these changes Dec 14, 2023

View reviewed changes

Nate-Smithline force-pushed the main branch from b44f782 to 20ec9e8 Compare December 14, 2023 23:01

dependabot bot and others added 5 commits December 14, 2023 18:20

Bump postcss from 8.4.20 to 8.4.31 in /website (cncf#1120)

513487a

Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

Removed template text and added more information for related vendors

248d6e2

Signed-off-by: nomnomninja <150766910+nomnomninja@users.noreply.github.com> Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

fixed first comment and added more details on who authored the doc

16303bf

Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

Nate-Smithline force-pushed the main branch from 20ec9e8 to 16303bf Compare December 14, 2023 23:20

Re-added the changes in actor section

710752d

Signed-off-by: Sunny Li <100388296+sunnnnyli@users.noreply.github.com>

smallfoot47 requested a review from ragashreeshekar December 15, 2023 02:13

sublimino reviewed Dec 15, 2023

View reviewed changes

Nate-Smithline added 2 commits December 15, 2023 11:09

Fixed all changes from Andrew, aka sublimino, thank you

1334051

Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

Fixed all changes from Andrew, aka sublimino, thank you

0118c4c

Signed-off-by: Nate-Smithline <nathan_m_smith@outlook.com>

torinvdb reviewed Jan 16, 2024

View reviewed changes

ragashreeshekar and others added 4 commits January 16, 2024 13:24

Update Containerd/self-assessment.md

a895bb1

Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Raga <ragashreeshekar@gmail.com>

Update Containerd/self-assessment.md

73c7c69

Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Raga <ragashreeshekar@gmail.com>

Merge branch 'main' into main

652ab5c

Merge branch 'main' into main

b817464

tuminoid mentioned this pull request Jan 23, 2024

GH actions are always failing to Git safe directory error, but returning success #1221

Closed

Merge branch 'main' into main

1ed697b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Containerd Project Security Self-Assessment - Security Pals #1202

Containerd Project Security Self-Assessment - Security Pals #1202

smallfoot47 commented Dec 8, 2023 •

edited

netlify bot commented Dec 8, 2023 •

edited

eddie-knight commented Dec 8, 2023

eddie-knight commented Dec 8, 2023

eddie-knight Dec 8, 2023

eddie-knight Dec 8, 2023

eddie-knight Dec 12, 2023

ragashreeshekar left a comment

ragashreeshekar Dec 13, 2023

ragashreeshekar Dec 13, 2023

ragashreeshekar Dec 13, 2023

sublimino Dec 15, 2023

sublimino Dec 15, 2023

sublimino Dec 15, 2023

sublimino Dec 15, 2023

sublimino Dec 15, 2023

sublimino Dec 15, 2023

sublimino Dec 15, 2023 •

edited

sublimino Dec 15, 2023

sublimino Dec 15, 2023

torinvdb Jan 16, 2024

torinvdb Jan 16, 2024

ragashreeshekar commented Jan 30, 2024

smallfoot47 commented Jan 31, 2024


		## Self-assessment use

		This self-assessment is created by the Containerd team to perform an internal analysis of the project's security. It is not intended to provide a security audit of Containerd, or function as an independent assessment or attestation of Containerd's security health.


		https://azure.microsoft.com/en-us/updates/generally-available-containerd-support-for-windows-in-aks/

		* Related Projects / Vendors:


		## Metadata

		A table at the top for quick reference information, later used for indexing.

		Provide the list of links to existing security documentation for the project. You may
		use the table below as an example:


		## Overview

		Containerd is a Cloud Native Computing Foundation (CNCF) Project focused on providing the core functionalities for container orchestration. Specifically architected to focus on modularity and compatibility, this provides a secure and minimal approach making it a great option for integrating into different container systems.

	Containerd is a Cloud Native Computing Foundation (CNCF) Project focused on providing the core functionalities for container orchestration. Specifically architected to focus on modularity and compatibility, this provides a secure and minimal approach making it a great option for integrating into different container systems.
	Containerd is a container runtime focused on providing the core functionalities for managing container lifecycles. Specifically architected to focus on modularity and compatibility, it provides a secure and minimal approach making it a great option for integrating into different container orchestrators.


		Containerd, a fundamental tool in the realm of containerization, provides a dependable and standardized approach to managing containers. It is a lightweight yet powerful container runtime, ensuring a consistent and efficient experience.

		Originally developed by Docker, Inc. as an integral part of the Docker project, Containerd has evolved with the dynamic container ecosystem. Docker's decision to separate container runtime functionality led to Containerd, an independent project dedicated to container management.


		- Compatibility:

		Aligned with the Open Container Initiative (OCI) specifications, Containerd ensures compatibility with other runtimes and tools adhering to the OCI standard. This compatibility facilitates easy transitions between container runtimes supporting OCI.


		- Containerd Core:

		Role: Serves as the core orchestration engine, managing the complete lifecycle of containers.

	Role: Serves as the core orchestration engine, managing the complete lifecycle of containers.
	Role: The core container orchestration engine, managing the complete container lifecycle.


		- Image Registries:

		Role: Acts as repositories for container images, collaborating with containerd in tasks such as image pulling, pushing, and managing metadata.

	Role: Acts as repositories for container images, collaborating with containerd in tasks such as image pulling, pushing, and managing metadata.
	Role: Repositories for container images, providing storage and retrieval for containerd in tasks such as image pulling, pushing, and metadata management.


		## Self-assessment use

		This self-assessment was authored by Swati Baleri, Vivek Radhakrishnan, Swati Baleri, Sunny Li, and Nathan Smith with a format established by the Containerd maintainers. The purpose of this document is to perform an internal analysis of the project's security. It is not intended to provide a security audit of Containerd, or function as an independent assessment or attestation of Containerd's security health.

Containerd Project Security Self-Assessment - Security Pals #1202

Are you sure you want to change the base?

Containerd Project Security Self-Assessment - Security Pals #1202

Conversation

smallfoot47 commented Dec 8, 2023 • edited

netlify bot commented Dec 8, 2023 • edited

✅ Deploy Preview for tag-security ready!

eddie-knight commented Dec 8, 2023

eddie-knight commented Dec 8, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ragashreeshekar left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sublimino Dec 15, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ragashreeshekar commented Jan 30, 2024

smallfoot47 commented Jan 31, 2024

smallfoot47 commented Dec 8, 2023 •

edited

netlify bot commented Dec 8, 2023 •

edited

sublimino Dec 15, 2023 •

edited