Security in technological infrastructure. Integration of best practices for Docker environments in DevOps pipelines

Abstract

The growing adoption of Docker containers has significantly improved the efficiency of software development and deployment. However, this agility entails significant security risks, such as image vulnerabilities, insecure configurations, and the lack of integration of security regulations into Continuous Integration and Delivery workflows. This research addresses the security challenges of Docker environments within DevOps pipelines, where the lack of automated integration of regulations and continuous vulnerability scanning exposes them to critical risks. An automated model is proposed that combines the CIS Docker Benchmark, OWASP Top 10, and NIST 800-53 controls, implemented using the NeuVector tool integrated into CI/CD pipelines. The findings reveal its effectiveness in strengthening security in academic and production environments, natively incorporating security into the secure software development lifecycle. Its extension to other container and orchestration technologies is recommended.