‫Is there any additional security recommendations specific
‫for Windows, containers? Windows containers, unfortunately,
‫is a whole, totally different thing.
‫Because Windows containers don't have SELinux, or AppArmor,
‫or Seccomp, or Linux capabilities.
‫They're Windows specific.
‫So, it would honestly end up being largely a different
‫list.
‫Things that aren't related are things like
‫scanning your images. Things like scanning
‫your code, right. Just using Docker would be
‫on that list.
‫Look at the first one there. Scanning your host.
‫Well, there is...as far as I know, there is no Docker Bench
‫for Windows. So, you couldn't do that.
‫Running your apps in containers as root.
‫Same thing in Windows.
‫Run your apps as not the Administrator user.
‫You would do that on Windows.
‫User namespaces I do not believe is a thing on Windows.
‫Windows has, for about every single one of these kernel
‫features, they don't have the same name.
‫They have something else that's similar.
‫It wouldn't be called user namespaces.
‫You could definitely do number five, code scanning for
‫Windows. You could scan Windows images, but a
‫lot of scanners don't support Windows.
‫You're going to have to find a very specific image scanner
‫that is designed for Windows dependencies, you know,
‫like .net 3.5 vulnerabilities, or
‫you know, a .net core 2.0 vulnerabilities.
‫Stuff like that.
‫The next one, running bad behavior.
‫This is only, as far as I know, this is only for Linux.
‫I do not believe Falco works on Windows.
‫Content trust is a general industry
‫practice. It's not so specific for production containers.
‫So, you can definitely sign images and sign code on
‫the Windows side.
‫Then, you would enable Docker.
‫I'm not sure if the Docker Engine has this feature,
‫so you can click this link essentially and read
‫about content trust and find out if Docker supports the
‫Engine features for that on Windows.
‫These obviously would not apply because these are Linux
‫specific.
‫Then, Docker Rootless does not run on Windows,
‫as far as I know. You can't do that on Windows.
‫That's a really quick way to get through the Windows list
‫and that's a great question.
‫I'm glad you asked about that one.