Security is the new competitive battleground for containers  Merely two weeks after Docker Inc. released a set of access control features to help prevent intrusions into production deployments of its namesake platform, CoreOS Inc. is upping the ante with a competing cryptographic framework that provides protection against tampering all the way down to the firmware.

The Distributed Trusted Computing suite enables administrators to encrypt the bootloader and the other components involved in starting up a server to ensure that hackers can’t exploit any potential low-level vulnerabilities to compromise the machine. That protects both against zero-day exploits and unpatched firmware, an almost inevitable occurrence in large organizations with upwards of hundreds of boxes to maintain. The rest is handled by the built-in Trusted Platform Module, which the framework configures to record the initialization of the operating system from start to finish.

The monitoring mechanism ensures that the copy of CoreOS’s Linux distribution installed on the server is not somehow modified to allow unauthorized external access. After it’s cleared to launch, the platform takes over the verification torch and runs a scan to ensure the rkt containers running on top are securely configured. The process is likewise logged in what the startup describes as a cryptographically verifiable audit trail that administrators can plug into their automation tools to receive an alert whenever something goes wrong. It’s also helpful for tracing security breaches after the fact.

The machine is only assigned sensitive data once both the operating system and the instances have been verified, which guarantees organizations a basic level of security in their CoreOS clusters that Docker does not yet match, at least not with the same degree of automation. The startup hopes that the combination of the Distributed Trusted Computing framework and the homegrown Clair vulnerability assessment tool unveiled last month will help better set its platform apart from better-funded competitor as containers start moving into production. But it’s unlikely Docker will let the launch pass unanswered given its own growing focus on security. 

Image via Pixelcreatures