DEVOPSdigest

Sonatype has incorporated Lifecycle Container Analysis (LCA) into its Nexus Lifecycle solution for automating the flow of components through modern software supply chains.

Modern development teams can now automatically examine the quality and security of application components within containers moving through their DevOps pipeline.

With the introduction of LCA, Nexus Lifecycle can now examine applications housed inside of containers in the same way that it evaluates the quality of components in traditional applications. This allows Nexus Lifecycle to surface intelligence with respect to the quality of things inside the container and automatically apply and manage governance policies based on the results. LCA will effectively allow Nexus Lifecycle to peek inside the containers and see if any of the Java, NuGet, npm, or JavaScript components have known security vulnerabilities, license risks, or quality problems.

“Security concerns are one of the chief reasons why organizations have not swiftly moved containers into production,” said Wayne Jackson, CEO of Sonatype. “Containers are just a new type of part flowing through modern software supply chains and with LCA, Nexus Lifecycle customers can be confident that the components inside their containers are the highest quality and free from known vulnerabilities.”