At the same time overlays move security closer to the app which shifts the purview left even further toward the developer. This might mean that developers will bear more of the burden of ensuring a secure deployment by choosing a good overlay and effectively operating that overlay in a way that satisfies Security and Compliance.
I've seen some companies try to go the route you're thinking. There are definitely high-security type of solutions that want, and need that level of control over the network. They are building solutions around OpenZiti to enable the observability part of the equation you're hinting at.
Generally, though, OpenZiti is ideally targeting applications. We'd love it if every app on the planet had their own bespoke, ubiquitous network connection which the developers could control. The network engineers can control the underlay like they want while the developer can control access to the overlay/apps like they want. Ideally, that would be a best of both worlds situation.
> And so, the corporate VPN inherits too much access also, so it works similarly to your desk. This! 100% nailed it. That's why the split vpn aspect is so important.
It’s not that they block them per se, they are just ignorant of them and so they can’t route them. Traditional VPNs rely on routing protocols like OSPF and BGP (with the occasional static route thrown in) to move traffic, and your docker overlays aren’t integrated with the netsec team’s routing infrastructure.
There's also workarounds for Windows using Powershell scripts and "Set-NetIPInterface -InterfaceMetric 6000" to lower the priority of the AnyConnect internal routes that break docker, or using wsl-vpnkit (as DockerDesktop does).
I think the shift away from trusted networks is long overdue and inevitable not only thanks to the needs of engineers and other employees, but especially since endpoints (and employees!) are so easily compromised anyway.
There’s a reasonable case to still block encrypted overlay networks from a defense in depth standpoint, since they could make detecting a compromise harder, but I think that at some point most places will stop bothering and shift towards monitoring systems instead of the network as well.
I know that some of it is fairly easy to detect, but Cyber also can't use the same old stranglehold techniques[1] they have in the past, because remote developers need to be able to use docker and other tools that use network overlays.
The old school approach of trying to block it all is based on, I assume, old style networks where the corporate office floor network has too much access to production. And so, the corporate VPN inherits too much access also, so it works similarly to your desk.
Perhaps this pushes more effort to make the VPN and office floor networks completely separate from anything important.
[1] For example, popular corporate VPN software products, like AnyConnect and GlobalProtect, are somewhat notorious for blocking things like Docker overlay networks by default.