Mirantis Kubernetes Engine vs. Sonatype Platform vs. VMware AppDefense (discontinued)

[Mirantis Cloud Native Suite (Docker Enterprise)] is the most advanced tool till now, which works as a VMs
and separates any single application from the dependencies. Also, this tool is
helping me in the agile development of the processes. It is strongly recommended to
almost all major organizations.

Incentivized

- Guidance on remediation is very good - Vulnerability detection is very good - Support is very good - Ability to ask PMs/POs open questions at Office Hours every month is very good - Support for languages is lacking (TIOBE Index Top20) - Some features are un-neededly hidden and make the usage more complex then it needs to be

Being a VMware product, AppDefense has the advantage of compatibility with all of the VMware product feature updates and patches ( ESXi, NSX, vCenter, etc.). Paired with Carbon Black, it's resource overhead is well-tuned compared to traditional antivirus products.

Incentivized

• Containers - Docker is the go-to when using Containers, which are super useful if you need an environment that works both for Windows and Linux
• Efficiency - Docker is very lightweight and doesn't demand too much from your CPU or server
• CI/CD - Docker is excellent for plumbing into your build pipeline. It integrates nicely, is reliable, and has an easy set up.

Incentivized

• Nexus firewall is a great feature enabled for all our proxy repositories which are used to download the third-party opensource packages.
• Nexus IQ is integrated with build stage to analyze the component against evaluation policy. This helps to figure out the application security standards.
• Nexus IQ is also having a feature to scan container images before it uploads to our private repository. This is great feature for container platforms.

• I think that the AppDefense approach is clever and sets it apart from other products. Having a baseline of normal behavior that I can see is something I haven't seen in another product before.
• AppDefense doesn't overload my systems with performance draining agents.
• AppDefense integrates with VMWare products I have or plan to purchase.
• Access to AppDefense support has been better than any other VMWare products.

Incentivized

• Containers are often opaque - if a container doesn't work out of the box, it's messy to fix.
• Logging is complexified by the multiple containers and logs are often not piped to places you expect them to be.
• Networking is complexified due to internal port mapping between containers, etc.

Incentivized

• Support on the end of life lifecycle of known open source components that are going end of life, or already went end of life
• Support for emerging infrastructure as code frameworks
• Support for native/ default retention, archiving and clean up policies for hosted repositories

• PowerShell functionality.
• Sorting results in some areas are not applicable.
• Email alerting through AppDefense Manager does not exist, but support has said it is a feature to come.

Incentivized

Sonatype supports more than 200 dev(s). It proves with the repository to store the artifacts. Allows for governance of open source software used by the different teams. It is used by security teams to scan for vulnerabilities in software(s) and in the deployed containers. It helps ensure code quality.

Incentivized

Docker's CLI has a lot of options, and they aren't all intuitive. And there are so many tools in the space (Docker Compose, Docker Swarm, etc) that have their own configuration as well. So while there is a lot to learn, most concepts transfer easily and can be learned once and applied across everything.

Incentivized

Overall experience is great with the Platform; however, I see some opportunity with upgrading the platform as it is missing with data of historical scans to allow reviewer to get view of trend how the application/product development team is considering fixing the issues.

Incentivized

Extremely good

Sonatype products are great value as I said but a few areas like how products use underlying resources in order to make it further lightweight, is something I would like them to consider.

The community support for Docker is fantastic. There is almost always an answer for any issue I might encounter day-to-day, either on Stack Overflow, a helpful blog post, or the community Slack workspace. I've never come across a problem that I was unable to solve via some searching around in the community.

Incentivized

Monthly touchpoints with Sinisa has been very valuable.

Incentivized

The product is still quite new, and there seems to be a lack of technical information available for both the E.U. and support staff. That being said, the support staff that I have worked with have always been very knowledgeable and ensure that they see a ticket through to completion.

Incentivized

easy to implement and performing the scans via automations as well

Incentivized

We've used XAMPP, PHPmyAdmin and similar local environments (our app is on PHP). Because of how easy you can change the configuration of libraries on PHP and versions (which is SO painful on XAMPP or other friendly LAMP local servers) we are using Docker right now. Also, being sure that the environment is exactly the same makes things easier for developing.

Incentivized

Out of other products we evaluated before choosing Sonatype, the later looked far more user friendly, easy to understand and work with. This was key for us, as the tool needs to be used by many engineers that don't have security as their main focus. Having a tool that is easy to understand and work with, makes the process of evaluating open source dependencies much easier and appealing for developers.

Incentivized

We have several security applications, but none exactly like VMware AppDefense. That is one of the reasons I like it, as it seems to take a different angle on monitoring and protection. The other apps monitor different things, but one thing AppDefense seems to have over them is a streamlined interface and not a lot of false positives.

Incentivized

Great value for money

Everything is very good except a little concern regarding large scale docker usage.

Very good

• Docker has made it possible for us to deploy code faster, increasing the productivity of our development teams.
• Docker has made it possible for us to decentralize our build and release system. This means that teams can deploy on their own schedule and our dev ops team can concentrate on building better tools rather than deploying for the teams
• Docker has allowed us to virtualize our entire development process and made it much simpler to build out new data centers. This, in turn, is significantly increasing our ROI by providing a path forward for internationalization.

Incentivized

• Sonatype's centralized management of artifacts have made it very easy for developers to share code in an efficient manner.
• Sonatype's low false positive rate has made it easier to convince developers to remediate vulnerabilities
• Sonatype's archaic architecture has made it more expensive to manage than it could be.

• As with everything now, automation is key. AppDefense effectively monitors the activity on all our VMs, freeing administrators to work on more projects
• Makes it much easier to diagnose issues when system are not running as intended

Incentivized