Red Hat SummitChapter 1. Red Hat Hardened Images for enterprise compliance
Red Hat Hardened Images provide a minimal, secure foundation for containerized workloads. These images reduce the attack surface because they contain only the absolutely necessary packages.
You can use the Red Hat Hardened Image without subscription.
1.1. What is Red Hat Hardened Images
Red Hat Hardened Images provide a minimal, secure foundation for containerized workloads. These lightweight images include only the libraries and runtime components required to run an application, effectively minimizing the attack surface.
Operational advantages of this reduced image size include:
- Faster deployment: Smaller image sizes result in faster pull times and reduce network traffic.
- Simplified auditing: Fewer packages reduce the time spent on vulnerability scanning and compliance reporting.
- Resource efficiency: Lower memory and storage requirements support higher container density on host systems.
The following measures are applied to ensure the security of each image:
- Minimal software footprint: Includes only essential software packages required for the workload to significantly reduce the attack surface and potential vulnerabilities.
- Rapid update deployment: Provides software package updates promptly to address vulnerabilities with minimal delay.
- Non-root user default: Enforces the principle of least privilege by avoiding root access within the container whenever technically possible.
- Hermetic build environment: Constructs images without network access to prevent package drift and maintain absolute control over software versions.
- Distroless security: Removes traditional operating system utilities. This makes common exploit techniques and navigating in the container impossible.
1.2. Select the right base image: Red Hat Hardened Images and Red Hat UBI
Choosing between Red Hat Hardened Images and the Red Hat Universal Base Image (UBI) depends on your security requirements and operational constraints. Red Hat Hardened Images offer a specialized environment for production-ready security, while UBI provides a flexible, general-purpose base.
| Feature | Red Hat Hardened Images | Red Hat UBI |
|---|---|---|
| Image size | Minimal. Contains only essential runtime dependencies. | Moderate. Includes standard utilities and a shell. |
| Package management | Does not include a package manager to prevent runtime changes. |
Includes the |
| Attack surface | Reduced. Excludes non-essential binaries to limit exploit paths. | Standard. Includes common troubleshooting utilities. |
| Use case | High-security, production-ready micro services. | General application development and deployment. |
| CVE goal | Aimed at zero common vulnerabilities and exposures (CVE) status for the runtime environment. | Standard security patching cycle. |
- When to choose Red Hat Hardened Images
- Production environments: Your environment is highly sensitive and must not include shells or utilities that unauthorized users can exploit.
- Static workloads: Your application has fixed dependencies and does not require the installation of new software during execution.
- Strict compliance: Your security standards or regulations require a documented and minimal software bill of materials (SBOM).
- When to choose Red Hat UBI
- Interactive debugging: Your manual troubleshooting or complex startup scripts require a shell environment.
- Dynamic builds: Your build process requires standard Red Hat Enterprise Linux (RHEL) utilities to install additional software.
- Enterprise lifecycle: Your workload requires long-term stability and security updates aligned with Red Hat Enterprise Linux.
1.3. The Red Hat Hardened Images catalog
The Red Hat Hardened Images catalog is a web-based application designed to help users discover, inspect, and integrate security-focused container images into their workflows.
You can use the Red Hat Hardened Image without subscription.
To access the catalog, open https://images.redhat.com in your browser.
Click an image tile to open the details for this image. You can select a tag and, optionally, filter the tags to display only Federal Information Processing Standard (FIPS) variants.
The details for an image contains the following tabs:
- Overview: Lists the available streams and variants. Additionally, this tab provides general usage information for the image.
- Tags: Lists all available images with additional information, such as size and when it was last updated.
- SBOM: Displays the software bill of materials (SBOM) for the selected image tag. The SBOM lists all software components, libraries, and dependencies in this Red Hat Hardened Image.
- Verify Build: Provides details on how to verify the image integrity.
- CVE Reporting: Lists all known vulnerabilities and exposures (CVE) for the selected image tag.
- Containerfile: Provides a download option for the Containerfile of the selected image.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}