Any comments on who put this together, or their long term goals?

Author here! I put this together because I was bit frustrated with the quality of teaching resources for my development team. (And I find the OWASP wiki a bit of a mess.)

Not sure about the business model yet, though it's peaked some interest here and on /r/programming, so I figure there's an appetite for good training material.

Signed up, got https://www.hacksplaining.com/profile.json

"Container usage is growing quickly and is carrying more and more of the computing needs, allowing for greater flexibility. We must secure them."

We must do X - any insight into how to do X, or what features X needs to have?

The logging drivers reduce a major production pain point - standardized centralized logging that doesn't require modifying the underlying image.

Docker has a bad security reputation; this is one more step in the right direction.

It's crazy that (until now) docker always logged stdout/stderr to a file, and never rolled it. Without a separately configured logrotate (in copy-truncate mode), these log files will grow without bound, until the container is removed (usually replaced).

Reminds me of the day I foolishly did "docker run -d debian yes" so I could play with some of the inspection commands. I forgot about it and an hour later it had eaten nearly all of my hard disk space...

It may be critically important, but they can't do everything at once. They're moving incredibly fast as it is.

Other people were attempting to solve this problem too - https://registry.hub.docker.com/u/kiyoto/docker-fluentd/

"Docker has a bad security reputation"

Ecept for ulimit, there is literally NO security improvement in this release.

Logging merely gives you a visibility - right, you get hacked but at least it's not painful to look for information, but I would really rather prefer not to get hacked due to the existing insecurities...

SecOps mission is: prevent, detect, respond.

Yes, outright prevention is important. Yet proper centralized log collection and intelligence helps with all three missions, including prevention.

Proper logging allows you to identify known-good behavior patterns and outlying anomalies. With profiles in place, one can automate blocking of reconnaissance and probes, not just blocking known vulnerabilities.

Other than privilege escalation through the kernel, what attack surface do you see exposed?

Might just be limited to my use case for Docker, but so far it's security agnostic.

What are your security concerns regarding Docker? Or what do you perceive to be common security flaws?

So far I've perceived Docker to be like virtualenv for python - useful but orthogonal to any security practices.