A deep dive into container security on AWS
summary
Walks through Linux container security layers (namespaces, cgroups, capabilities, seccomp) and shows how to profile real containers with strace and top to derive a minimal seccomp profile and capability set, then apply them in EKS/ECS (Fargate disallows extra privileges). Recommends least-privilege over privileged mode, warns that adding capabilities can widen allowed syscalls, and claims Prisma Cloud automates code-to-cloud controls—one customer drops alerts from 15,000 to 2,500 after deployment.
AI-written summary · about
chapters (12)
- 0:00Introduction and context
- 2:04Palo Alto Networks overview
- 3:51Container security fundamentals
- 7:01Risks of container operations
- 9:40Privileged containers and risk
- 13:11Least privilege strategy
- 14:44Security layers in depth
- 22:11Profiling container privileges
- 25:39Applying security on AWS
- 29:34Summary of security practices
- 30:41Prisma Cloud platform
- 41:10Customer success and closing
related talks
38mContainer Security, capabilities an seccomp profiles
19mSecurity foundations for containers
33mContainers Security Layers and How Not to Break them
23mSecurity in a containerized world
50mThe state of container security
46mSecuring Applications and Pipelines on a Container Platform
05mContainer Security Best Practices
32mSecuring Kubernetes Applications by Crafting Custom Seccomp Profiles