Just wondering - is anyone out there using Docker containers in the payment card industry? Any issues with the DSS standars?

Yes we just passed a level 1 PCI compliance but it took some customization of the base server and registry. Once you have those done you’re good to go.

@jruffer are you able to throw some light on what are the customizations and/or why they are required?

Certainly. I am going to do an article on it early next week. If you want to throw me a network diagram in the meantime I am happy to tell you what is in scope.

Our plan is to put up a registry for just projection purpose only, on a separate subnet from production servers. These will then be treated as within scope. Just curious what are those customizations alluded to? Are they network based or the docker and registry application themselves?

@jruffer , have you written that article? I’m interested to see what is required to make a docker container PCI compliant. My guess is the container needs to be custom-built as far as possible and run on a self-managed registry. The container is read-only, so is an anti-virus still required inside th…

@jruffer , @mcpken Did that article ever come through, we are very interested in any success stories with docker in PCI DSS land.

My apologies. I switched projects after achieving PCI level 1 compliance. Shoot me an email I’ll try to help

not sure how to send you an email, but you may take my email address kartik.unix@gmail.com and send me one so I have your email address

@jruffer did you get my email address?

Docker & PCI DSS Compliance

General

stamod11 (Stamod11) January 5, 2017, 12:12am 12

A concrete crisp guide for Docker PCI-DSS compliance https://info.twistlock.com/guide-to-pci-compliance-for-containers

Topic		Replies	Views
How to access PCI device from a Docker container General	2	17788	September 27, 2019
Docker for Banking industry Compose	0	1587	August 12, 2016
Does an application have to written with containerisaiton-cautious in mind so that it can run in production in Docker container General	0	544	December 8, 2017
Docker Enterprise and non-FIPS crypto Docker Hub	0	710	May 29, 2019
Create Docker Registry outside docker container Docker Engine	0	1206	April 27, 2016

Docker & PCI DSS Compliance

Related topics