Docker slim minify's and secure's Docker containers. Keep doing what you are doing. No need to change anything. Use the base image you want. Use the package manager you want. Don't worry about hand optimizing your Dockerfile. You shouldn't have to throw away your tools and your workflow to have small container images.
 
docker-slim will optimize and secure your containers by understanding your application and what it needs using various analysis techniques.

Docker slim minify's and secure's Docker containers. Keep doing what you are doing. No need to change anything. Use the base image you want. Use the package manager you want. Don't worry about hand optimizing your Dockerfile. You shouldn't have to throw away your tools and your workflow to have small container images.



DockerSlim (docker-slim) - Optimize and secure your Docker containers

Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes. Cilium operates at Layer 3/4 to provide traditional networking and security services as well as Layer 7 to protect and secure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium is integrated into common orchestration frameworks such as Kubernetes.
 
A new Linux kernel technology called eBPF is at the foundation of Cilium. It supports dynamic insertion of eBPF bytecode into the Linux kernel at various integration points such as: network IO, application sockets, and tracepoints to implement security, networking and visibility logic. eBPF is highly efficient and flexible.

Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes. Cilium operates at Layer 3/4 to provide traditional networking and security services as well as Layer 7 to protect and secure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium is integrated into common orchestration frameworks such as Kubernetes.

Cilium -  eBPF-based Networking, Security, and Observability

ORY Hydra is a hardened, OpenID Certified OAuth 2.0 Server and OpenID Connect Provider optimized for low-latency, high throughput, and low resource consumption. ORY Hydra is not an identity provider (user sign up, user login, password reset flow), but connects to your existing identity provider through a login and consent app. Implementing the login and consent app in a different language is easy, and exemplary consent apps (Go, Node) and SDKs are provided.

ORY Hydra - OpenID Connect and OAuth Provider written in Go

ZITADEL provides you with all the features necessary to build great solutions, without the need of building the login and access management yourself. 
 
Its features include: 
<ul><li>Authentication:&nbsp; OpenID Connect 1.0 Protocol (OP), Username / Password,&nbsp; Machine-to-machine (JWT profile), Passwordless with FIDO2</li><li>Multifactor authentication with OTP, U2F</li><li>Federation with OpenID Connect 1.0 Protocol (RP), OAuth 2.0 Protocol (RP)</li><li>Authorization via Role Based Access Control (RBAC)</li><li>Identity Brokering</li><li>Delegation of roles to other organizations for self-management</li><li>Strong audit trail for all IAM resources</li><li>User interface for administration</li><li>APIs for Management, Administration, and Authentication</li><li>Policy configuration and enforcement</li><li>Private Labeling</li></ul>

ZITADEL provides you with all the features necessary to build great solutions, without the need of building the login and access management yourself. 

ZITADEL - Cloud Native Identity and Access Management

SpiceDB is a database system for managing security-critical application permissions. Developers create a schema that models their permissions requirements and use a client library to apply the schema to the database, insert data into the database, and query the data to efficiently check permissions in their applications.
 
The data used to calculate permissions have the most critical correctness requirements in the entirety a software system. Despite that, developers continue to build their own ad-hoc solutions coupled to the internal code of each new project. By developing a SpiceDB schema, you can iterate far more quickly and exhaustively test designs before altering any application code. This becomes especially important as you introduce backwards-compatible changes to the schema and want to ensure that the system remains secure.

SpiceDB is a database system for managing security-critical application permissions. Developers create a schema that models their permissions requirements and use a client library to apply the schema to the database, insert data into the database, and query the data to efficiently check permissions in their applications.

SpiceDB - Inspired by Google's Zanzibar paper, SpiceDB is a database system for managing security-critical application permissions

Ecoji encodes data as 1024 emojis, its base1024 with an emoji character set. As a bonus, includes code to decode emojis to original data. The difference between Ecoji and Base64 is that Ecoji is more bytes, but less visible characters. With Ecoji each visible char represents 10 bits, but each character is multi-byte. With base64 each char represents 6 bits and is one byte. 

Ecoji - Encodes (and decodes) data as emojis

Kubescape is an open-source Kubernetes security platform. It includes risk analysis, security compliance, and misconfiguration scanning. Targeted at the DevSecOps practitioner or platform engineer, it offers an easy-to-use CLI interface, flexible output formats, and automated scanning capabilities. It saves Kubernetes users and admins precious time, effort, and resources.
Kubescape scans clusters, YAML files, and Helm charts. It detects misconfigurations according to multiple frameworks (including&nbsp;<a href="https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">NSA-CISA</a>,&nbsp;<a href="https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/" target="_blank" rel="noopener">MITRE ATT&amp;CK </a>and the&nbsp;<a href="https://www.armosec.io/blog/cis-kubernetes-benchmark-framework-scanning-tools-comparison/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">CIS Benchmark</a>).
Kubescape uses&nbsp;<a href="https://github.com/open-policy-agent/opa" target="_blank" rel="noopener">Open Policy Agent</a>&nbsp;to verify Kubernetes objects against&nbsp;<a href="https://github.com/kubescape/regolibrary" target="_blank" rel="noopener">a library of posture controls</a>. By default, the results are printed in a console but they can be exported to JSON and PDF.
Kubescape is running the following tests according to what is defined by Kubernetes Hardening Guidance by NSA and CISA.
<ul>
<li>Non-root containers</li>
<li>Immutable container filesystem</li>
<li>Privileged containers</li>
<li>hostPID, hostIPC privileges</li>
<li>hostNetwork access</li>
<li>allowedHostPaths field</li>
<li>Protecting pod service account tokens</li>
<li>Resource policies</li>
<li>Control plane hardening</li>
<li>Exposed dashboard</li>
<li>Allow privilege escalation</li>
<li>Applications credentials in configuration files</li>
<li>Cluster-admin binding</li>
<li>Exec into container</li>
<li>Dangerous capabilities</li>
<li>Insecure capabilities</li>
<li>Linux hardening</li>
</ul>

An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters.



Kubescape - An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters

Acra helps you to easily secure your databases in distributed, microservice-rich environments. It allows you to selectively encrypt sensitive records with strong multi-layer cryptography, detect potential intrusions and SQL injections and cryptographically compartment data stored in large sharded schemes. It's security model guarantees that compromising the database or your application does not leak sensitive data, or keys to decrypt it. 
 
Acra gives you means to encrypt the data on application side into a special cryptographic container, store it in the database and then decrypt in secure compartmented area (separate virtual machine/container). Cryptographic design ensures that no secret (password, key, anything) leaked from the application or database is sufficient to decrypt protected data chunks which originate from it.

Acra helps you to easily secure your databases in distributed, microservice-rich environments. It allows you to selectively encrypt sensitive records with strong multi-layer cryptography, detect potential intrusions and SQL injections and cryptographically compartment data stored in large sharded schemes. It's security model guarantees that compromising the database or your application does not leak sensitive data, or keys to decrypt it. 

Acra - Database protection suite with selective encryption and intrusion detection

Discover open source projects across all platforms

Projects