With the acceleration of digital transformation during the COVID-19 pandemic and the move toward modernizing business IT infrastructure, developers are increasingly aware of the potential of containerization.

The question everyone was asking before was about the difference between containers and virtual machines, but now it’s about what containers allow developers and businesses to build, according to Justin Cormack (pictured), chief technology officer of the software container company Docker Inc.

“I think that now we’re talking about what’s the effect of containers on the industry as a whole? What are the things that we can learn about repeatability and documentation and metadata and reliability,” he said. “Containers are not about that kind of security and escape piece; they’re about the content, the supply chain and your actual process of working.”

Cormack spoke with John Furrier, host of theCUBE, SiliconANGLE Media’s livestreaming studio, during DockerCon. They discussed how developers are working in a growing containerized world, the role of automation in making the work more efficient and the importance of security. (* Disclosure below.)

Automation helps developers build and test

Automation plays a very important role in improving the experience of developers in this modern infrastructure, according to Cormack. Most parts of any modern application consist mainly of open-source software, which need to be updated, scanned and reliable.

This process of bringing in components to build the applications is what the software supply chain is. Automation comes in here to help developers deal with this diverse software and the ongoing processes of building, testing and scanning.

“As software developers, we fundamentally know that the most valuable things are the things that we automate,” he explained. “A lot of building a software is about building repeatable processes, rather than just doing things one by one, because we know that we have to keep updating software, we have to keep fixing bugs, we have to keep improving software.”

As a company that wants to make development more efficient, Docker believes that it should help build processes rather than helping developers do something just once, according to Cormack. It also understands that the automation process needs to be simple.

“Why isn’t it as easy to make something automated as it is to do it once? There’s no real reason why it shouldn’t be,” he stated.

Shifting security to the left even further

Another key piece in the developers’ environment is security. Although Cormack considers the shift-left approach – which refers to moving security sooner in the development process — very important, he believes this should go even further.

“I think shift-left can just mean ‘ask the developers to do everything,’ which is really a bit too much,” he said. “I think that sometimes things need to be shifted even further left than people have actually thought.”

This means that the process of scanning and updating components, for example, must be done even before the developers get there rather than leaving the job to them. This is a way to help developers with the not always obvious and natural element of security.

“So, there’s a lot of work to do to educate and help and build tools that help developers there,” Cormack pointed out.

Another important point relates to supply chain security. Since containers allow developers to control the components they use to create applications, it is necessary to build tools that help developers understand what is in a container, where it came from and how it was built, according to Cormack.

“That’s your end-to-end supply chain,” he said. “It’s everything from developer inputs through the build process and grow to production — and in production — understanding whether it needs to be updated and whether there are new discovered vulnerabilities and whether it’s being attacked and how that relates back to what came into it in the first place.”

Watch the complete video interview below, and be sure to check out more of SiliconANGLE’s and theCUBE’s coverage of DockerCon. (* Disclosure: Docker Inc. sponsored this segment of theCUBE. Neither Docker nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE