Logo of Osakidetza, the Basque Health Service, featuring a modern design with clouds and abstract elements.

256_cta-background.webp

384_cta-background.webp

640_cta-background.webp

750_cta-background.webp

828_cta-background.webp

thumbnail_cta-background.webp

osakidetza-logo

Daar hebben wij de oplossing voor

Wilt u efficiënter werken? 

Abstract digital background featuring interconnected lines and glowing points in shades of blue and green.

1080_background.webp

1200_background.webp

256_background.webp

384_background.webp

640_background.webp

750_background.webp

828_background.webp

thumbnail_background.webp

atmosphere-water-sky-azure-electricity-astronomical-object-slope-electric-blue

Logo of Zen Software in white on a transparent background.

1080_zen-logo-white.webp

1200_zen-logo-white.webp

256_zen-logo-white.webp

384_zen-logo-white.webp

640_zen-logo-white.webp

750_zen-logo-white.webp

828_zen-logo-white.webp

thumbnail_zen-logo-white.webp

zen-logo-white.webp

ZEN Software

1080_zen-logo-black.webp

1200_zen-logo-black.webp

256_zen-logo-black.webp

384_zen-logo-black.webp

640_zen-logo-black.webp

750_zen-logo-black.webp

828_zen-logo-black.webp

thumbnail_zen-logo-black.webp

západoslovenská energetika-logo

Project Reinforcement

New Software Project / Modernisation

Tech Consultancy

Cloud Consultancy

What We Do

Cases

About us

News

Contact

Success! You`ve been added to our email list.

Subscribe to our email list and we will keep you updated on DevOps and ZEN Software News and Trends

Subscribe to ZEN Software's  newsletter

New Relic event in Amsterdam

Tech future unveiled: Evt with Projection-screen Curtain,

projection-screen-curtain-public-speaking-display-device-event-stage-equipment-electronic-device-technology

New Relic hosted an event in Amsterdam and I was happy to provide their customers about the use of New Relic and how to integrate their Application Performance Management tools into a large e-commerce platform.

New Relic provides key insights into both performance and stability of the platform, both microservices and the monolith backend.

At ZEN Software we’re able to help your organisation implement Application Performance Monitoring and provide your teams valuable insights into the software the teams are building and deploying

New Relic hosted an event in Amsterdam and I was happy to provide their customers about the use of New Relic and how to integrate their Application Performance Management tools into a large e-commerce platform.

New Relic provides key insights into both performance and stability of the platform, both microservices and the monolith backend.

Contact us

At ZEN Software we’re able to help your organisation and provide your teams valuable insights into the software the teams are building and deploying.

Want to implement Application Performance Monitoring?

implement

Ask a Cloud Export

Transform your software organisation to a cloud native, born (again) in the cloud enterprise

cloud, native

How to Simply Run a Docker Container in the Cloud

A group of people attentively listening to a speaker explaining container deployment on Kubernetes.

chair-t-shirt-fan-engineering-recreation-audio-equipment-technology-crowd

Setting up and operating a Kubernetes cluster is becoming increasingly complex. Simply running a website using a hand full of Docker containers should not be difficult to set up and operate. 

Setting up and operating a Kubernetes cluster is becoming increasingly complex. Simply running a website using a hand full of Docker containers should not be difficult to set up and operate. **Running containers in the cloud should be as easy as a deploy command**, letting the cloud provider sort out all the scaling, healing and operations bits and pieces. 

This post will describe several Managed Container Services from AWS, Azure and Google Cloud for running Docker containers in the cloud. I will discuss the benefits of using an MCS and highlight some of the best MCS solutions available, including AWS ECS, AWS Lambda, AWS App Runner, Azure Container Instances, and Google Cloud Run.

Some of the advantages of using a Managed Container Service (MCS) are:

- **Cost reduction**:  MCS eliminate the time, effort, and money spent on maintaining secure infrastructure to run your container.
- **Flexibility**: you can easily move from cloud to cloud or back to your on-prem infrastructure, freeing you from vendor lock-in.
- **Speed**: Since the underlying infrastructure abstracts from it, you can deploy your container quicker.

Overall, MCS will simplify the running process of a software application and improve overall security around it, as most [CaaS solutions](/what-we-do/solutions/content-at-any-scale-caas) offer vulnerability scans.  Furthermore, you don’t have to worry about managing the hardware that will run your container.

Best Managed Container Service (MCS) Solutions:

Here are some of the top Managed Container Service solutions available in the market:

AWS ECS is a fully managed container orchestration service that Amazon Web Services (AWS) provides. It enables you to run containers on a cluster of EC2 instances or AWS Fargate, a serverless compute engine for containers. ECS offers robust container management capabilities, including automatic scaling, load balancing, and integration with other AWS services. It provides granular control over container placement, allowing you to define task definitions and manage container instances efficiently.  With ECS, you can use your preferred container orchestration tools, such as Docker CLI or Kubernetes.

AWS Lambda is a serverless compute service that allows you to run code without provisioning or managing servers. While Lambda is primarily designed for running short-lived functions, it also supports running container images as an execution environment. With Lambda, you can package your application or service into a container image and automatically scale it based on incoming requests or events. It offers high scalability, cost efficiency, and ease of deployment without managing the underlying infrastructure.

AWS App Runner is a fully managed service that simplifies containerised application deployment. It provides a streamlined experience by abstracting away infrastructure and container orchestration complexities. With App Runner, you can directly deploy your source code or container image from various sources, including Git repositories or container registries. It automatically builds, deploys, and scales your applications based on the provided source, enabling rapid application delivery. App Runner supports multiple programming languages and frameworks, making it accessible to a wide range of developers.

Azure Container Instances is a serverless container offering provided by Microsoft Azure. It allows you to run containers without managing the underlying infrastructure. ACI offers fast and fine-grained container deployment, where you can spin up containers in seconds and pay only for the resources consumed per second. It supports Linux and Windows containers and integrates seamlessly with other Azure services.  ACI provides flexibility in terms of container instance sizing and scaling, making it suitable for various workloads, from simple to complex applications.

Google Cloud Run is a fully managed compute platform offered by Google Cloud. It enables you to run stateless HTTP-driven containers in a fully managed environment. Cloud Run abstracts away the underlying infrastructure and scales your containers automatically based on incoming requests. It supports both container images and source code deployment, providing flexibility for developers. Cloud Run offers seamless integration with other Google Cloud services and provides a pay-per-use pricing model.

Each of these container services in the cloud offers unique features and capabilities:

- **AWS ECS provides** comprehensive container management and orchestration capabilities, suitable for more complex deployments.
- **AWS Lambda allows** serverless execution of code or containers, providing scalability and cost efficiency for event-driven workloads.
- **AWS App Runner** simplifies containerised application deployment from various sources, focusing on rapid application delivery.
- **Azure Container Instances** offers serverless container deployment, fast startup times, and fine-grained resource consumption.
- **Google Cloud Run** is a fully managed platform for running stateless containers with automatic scaling and seamless integration with Google Cloud services.

Our [Content At Any Scale-solution](/what-we-do/solutions/content-at-any-scale-caas) (CaaS) leverages Managed Container Services to empower websites to achieve hyper-scale, seamless deployment, and high performance. Combining Content Delivery Network (CDN) and Managed container services from AWS or GCP, we cater to customer needs.

**Content at any Scale** leverages CDNs for lightning-fast content delivery to global users. CDNs distribute website content to edge locations, minimizing latency and improving user experience.

Managed container services from AWS or GCP enable efficient and scalable containerised application deployment. We offer AWS ECS, Lambda, App Runner, or GCP's Cloud Run, meeting diverse requirements.

With [CaaS](/what-we-do/solutions/content-at-any-scale-caas) :cheese:, your website handles increased traffic, deploys updates seamlessly, and ensures an excellent user experience. Experience the power of Content at any Scale from ZEN Software for digital success.

Recruitment event at Praxis

Microphone, Guitar, Audio-equip: stage ready for music

microphone-event-guitar-audio-equipment-room-projection-screen-stage-equipment-font

For Maxeda, together with our recruitment partners, we celebrated the fact that we hired 12 people to our digital team in NL & BE. We celebrated this by showing the world what we have achieved and what our plans are for the future. Want to work in a great and innovative digital e-commerce team? [We’re hiring](https://www.werkenbijpraxis.nl/)!

New Relic event at Okura Amsterdam

Public speaker delivering a tech presentation in a suit, to a crowded room

table-chair-suit-public-speaking-crowd-technology-projection-screen-event

When New Relic hosted an event, I was happy to share with their customers what we were up to at Maxeda. Our Cloud Transformation is in progress and our first phase of architecture design is complete.

After the talk the team went for a drink in the Okura bar. This was the exact moment that the platform started to bork. Luckily we were able to use New Relic and the present cloud team to debug the site and get it up and running in no time flat.

PostgreSQL vulnerabilities in cloud-managed databases

A fluffy electric-blue cloud sky filled with meteorological-phenomen

cloud-sky-cumulus-electric-blue-meteorological-phenomenon

Based on research by [Wiz.io](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities): The uncovered vulnerabilities by Wiz were the result of a **bug in the code that cloud vendors introduced** to the Postgress to make it fit their Clouds, not in the core of the PostgreSQL codebase. These vulnerabilities could be used as the initial stepping stone required for more complex attacks, such as in cross-tenant vulnerabilities like [ExtraReplica](https://www.wiz.io/blog/wiz-research-discovers-extrareplica-cross-account-database-vulnerability-in-azure-postgresql/).

Based on research by [Wiz.io](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities): The uncovered vulnerabilities by Wiz were the result of a **bug in the code that cloud vendors introduced** to the Postgress to make it fit their Clouds, not in the core of the PostgreSQL codebase. These vulnerabilities could be used as the initial stepping stone required for more complex attacks, such as in cross-tenant vulnerabilities like [ExtraReplica](https://www.wiz.io/blog/wiz-research-discovers-extrareplica-cross-account-database-vulnerability-in-azure-postgresql/). Disclosed in April 2022, ExtraReplica could allow attackers to access the databases of other customers in Azure Database for PostgreSQL (Flexible Server).

PostgreSQL is a 25-year-old project. It was first designed and developed before cloud computing and managed services even existed, so its authors could not possibly have anticipated the future needs of the cloud. When Cloud Providers started adapting PostgreSQL for managed database solutions, they discovered that it lacked a permissions model suitable for a managed service. Customers were accustomed to having full admin capabilities over their non-cloud managed databases, but Cloud providers could not allow customers to have capabilities that might endanger the security or stability of PostgreSQL-as-a-Service in the cloud. For example, all Cloud Providers offer customers similar semi-admin capabilities such as creating [event triggers](https://www.postgresql.org/docs/9.3/event-triggers.html), [checkpoints](https://www.postgresql.org/docs/current/sql-checkpoint.html), loading [extensions](https://www.postgresql.org/docs/current/sql-createextension.html), managing replications and more. But at the same time, Cloud Providers restrict customers from accessing the file system of the compute instance hosting the database, or executing code on the underlying server.

Exploiting Google Cloud SQL: Privilege Escalation and Code Execution

Wiz.io came up with the following attack flow:

1. Create a new table.
2. Insert some dummy content into the table, so the index function has something to work with.
3. Create a malicious index function (with our code execution payload) on the table.
4. ALTER the table owner to cloudsqladmin, GCP’s superuser role, used only by Cloud SQL to maintain and manage the database.
5. ANALYZE the table, forcing the PostgreSQL engine to switch user-context to the table's owner ( cloudsqladmin ) and call the malicious index function with the cloudsqladmin permissions, resulting in executing our shell command, which we did not have permission to execute before.

After executing the exploit SQL query, the ```shell_commands_results``` table contains the output of the executed code:


The first step is successful: let’s see if we can unlock the VM underneath and add a user; allow that new user access to the VM. After the phase 2 script ran, we tried to log in with our newly created user:

Success! As a bonus our user was a sudoer, granting us root privileges on the host.

Shortly thereafter, we received the following email:

Wiz promptly shared their findings in a detailed report and began collaborating on mitigation for these kinds of attacks.

Exploiting Azure Database for PostgreSQL: Privilege Escalation and Code Execution

Like GCP, Microsoft Azure has introduced some modifications to the PostgreSQL engine in order to offer PostgreSQL-as-a-Service in the cloud. As with Cloud SQL, these modifications allow users certain superuser capabilities such as creating event triggers, creating checkpoints and loading extensions, all of which are usually reserved for superusers.

When Microsoft set out to offer PostgreSQL-as-a-Service, all Cloud Providers had the same fundamental need: overcoming PostgreSQL’s inability to allow some superuser privileges to users without allowing everything else. Thus, all Cloud Providers were forced to introduce modifications to the PostgreSQL project. The core problem is that introducing admin capabilities to low-privileged users is risky. A seemingly minor modification can allow users to bypass the security model and elevate their privileges within the local database. Because Cloud Providers tend to introduce very similar capabilities, we were able to prove the same exploit code working on multiple vendors, even though the implementation code was different across different Cloud Providers.

Wiz managed to exploit the ```CREATEROLE``` permission and by adding a new user to the database were able to easily execute a reverse shell.


Success! and no mail by Microsoft :disappointed:. “Hey, guys, what are you up to?” 

Wiz demonstrated with this research the importance of Cloud Isolation. In the case of **Google Cloud SQL**, where tenant-isolation measures are strictly enforced, the impact of the vulnerabilities we found was **relatively small**. On the other hand, in the case of **Azure PostgreSQL**, where the isolation of the service was less strict, these kinds of vulnerabilities could have been leveraged to gain unauthorized cross-tenant access to the **database instances belonging to other customers**. 

If you want to know more about the exploits, scripts and details: be sure to check [out the original blog post by Wiz on the matter](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities).

Is it Cloud Native or Native Cloud? 

"Electric-blue Brand Graphics Rectangle Logo w/ 'CLOU

font-electric-blue-brand-graphics-logo-rectangle-trademark

**Is there a difference?**

While it looks like the terms are identical, at ZEN Software we make a distinction between the two terms. Googling for ‘Cloud Native’ returns the same result as for ‘Native Cloud’. Let’s just imagine that Google cares more about keywords than keyword order. Even so: there is a difference when using the words in a specific order. 

Let’s see

While it looks like the terms are identical, at ZEN Software we make a distinction between the two terms. Googling for ‘Cloud Native’ returns the same result as for ‘Native Cloud’. Let’s imagine that Google cares more about keywords than keyword order. Even so: there is a difference when using the words in a specific order. Let’s see.

**Cloud-native computing** is a software development approach that uses [cloud computing](https://en.wikipedia.org/wiki/Cloud_computing) to “build and run scalable applications in modern, dynamic environments such as [public](https://en.wikipedia.org/wiki/Cloud_computing#Public_cloud), [private](https://en.wikipedia.org/wiki/Cloud_computing#Private_cloud), and [hybrid](https://en.wikipedia.org/wiki/Cloud_computing#Hybrid_cloud) clouds”. Technologies such as [containers](https://en.wikipedia.org/wiki/OS-level_virtualization), [microservices](https://en.wikipedia.org/wiki/Microservices), [serverless](https://en.wikipedia.org/wiki/Serverless_computing) functions and immutable infrastructure deployed via [declarative](https://en.wikipedia.org/wiki/Declarative_programming) code are common elements of this architectural style.

These techniques enable loosely coupled systems that are resilient, manageable, and observable. Combined with robust automation, they allow engineers to make high-impact changes frequently and predictably with minimal toil.

Frequently, [cloud-native](/what-we-do/solutions/zen-cloud-landing-zone) applications are built as a set of microservices that run in [Docker](https://en.wikipedia.org/wiki/Docker_(software)) containers and may be [orchestrated](https://en.wikipedia.org/wiki/Orchestration_(computing)) in [Kubernetes](https://en.wikipedia.org/wiki/Kubernetes) and managed and deployed using [DevOps](https://en.wikipedia.org/wiki/DevOps) and [Git CI](https://en.wikipedia.org/wiki/Git) workflows (although there is a large amount of competing [open source](https://en.wikipedia.org/wiki/Open-source_software) that supports cloud-native development). The advantage of Docker [containers](https://en.wikipedia.org/wiki/OS-level_virtualization) is the ability to package all software needed to execute into one executable package. In addition, the container runs in a virtualised environment, which isolates the contained application from its environment.

**Native Cloud** should be seen as ‘Native to this cloud’. While techniques like [containers](https://en.wikipedia.org/wiki/OS-level_virtualization) and [orchestration](https://en.wikipedia.org/wiki/Orchestration_(computing)) via [Kubernetes](https://en.wikipedia.org/wiki/Kubernetes)  have open solid standards that can be implemented easily cross-Cloud.  Serverless functions like AWS’s Lambda are tied to their cloud provider (AWS).

To specify, we are talking of a Cloud specific technology that (can or cannot be Cloud Native) we use the term **Native** (to the) **Cloud**.


1080_a0e99bb3-c61d-4cc5-8eb4-cabcf11449eb.webp

256_a0e99bb3-c61d-4cc5-8eb4-cabcf11449eb.webp

384_a0e99bb3-c61d-4cc5-8eb4-cabcf11449eb.webp

640_a0e99bb3-c61d-4cc5-8eb4-cabcf11449eb.webp

750_a0e99bb3-c61d-4cc5-8eb4-cabcf11449eb.webp

828_a0e99bb3-c61d-4cc5-8eb4-cabcf11449eb.webp

thumbnail_a0e99bb3-c61d-4cc5-8eb4-cabcf11449eb.webp

"Tech fashion: laptop with projection screen on floor, property of New

New Relic event in Amsterdam

Want to implement Application Performance Monitoring?

Transform your software organisation to a cloud native, born (again) in the cloud enterprise

Read more:

New Relic event in Amsterdam

How to Simply Run a Docker Container in the Cloud

Recruitment event at Praxis

New Relic event at Okura Amsterdam

PostgreSQL vulnerabilities in cloud-managed databases

Is it Cloud Native or Native Cloud?

Subscribe to ZEN Software's newsletter