To summarize what we've seen in this short course,
which revolved all around Dockle, the feature that Dockle
supports, but we haven't seen in this course so far, is
supporting private registry servers.
Yes, Dockle can be used with private registry servers.
Dockle is still under active development, and this is important
to know because sometimes open source tools start out really
nice, but then they fizzle and fade.
Hopefully, you've seen from the demos that Dockle is easy to
use within pipelines within a continuous integration
environment, and this is very important.
Hopefully, you've also seen that Dockle can be utilized to perform quick wins,
quick results, quick mitigations, quick enhancement of security.
Does Dockle have competitors?
Of course. I'd say the biggest competitor in the space is
Hadolint, the Haskell‑based Dockerfile linter, which also is
immediately the difference between them.
Hadolint lints Dockerfiles, and Dockle lints Docker images.
Then you also have the tool, Docker Bench for Security, from Docker itself.
That tool is more focused on the Docker host security, and it cannot
be used in continuous integration environments.
You also have several container registry scanning services. At this
point in time, too many to mention separately.
This is completely different, and the results can vary wildly between the
service that you use. So personally, I'd say the biggest competitor, if you can
speak of competitors in the space, would be Hadolint.
Hadolint is also easy to use within continuous integration environments
and actually serves a more or less different purpose.
Once again, with Hadolint, you lint Dockerfiles, and
with Dockle, you lint Docker images.
They can happily exist within the same pipeline, either serial or parallel.
For more information about Dockle, please check the Dockle documentation itself,
which can be found on GitHub. For other information.
I'd like to refer you to the NIST cybersecurity framework.
More information about the cybersecurity framework can be found on Pluralsight
where you have multiple courses on that specific subject.
There are also courses with regards to automated security
testing, and this is more or less what we did today.
We looked at automated security testing about tools,
which we can use in pipelines.
Thank you so much for watching.
Hopefully, you learned something about Dockle or you learned about Dockle.
If you have any questions or comments,
feel free to drop them at the course discussion page on
Pluralsight. I had a lot of fun creating this course, and I hope
you had a lot of fun watching it. Until next time.