Cloud-Native Sandboxes for Microservices: Understanding New Threats and Attacks
summary
A container-native sandbox integrates with Kubernetes via a CRD to reconstruct real execution environments from Dockerfiles, image names or live cluster metadata and to run multiple lightweight containers under parallel execution and alignment analysis. System calls are captured with sysdig collection, filtered, normalized and compressed to 10–30% length, then aligned with a custom score that weights importance, closeness and sensitivity. Strong isolation uses Kata/gVisor layers. Experiments show the system pinpoints exploit traces (e.g., remote command injection) and produces actionable signatures far faster than VM sandboxes.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:48Agenda
- 5:26Motivation
- 9:43Context
- 12:42Sample Behaviors
- 13:58What is Parallel Execution
- 16:07Performance Issues
- 17:18Scoring Issues
- 18:18Security Analysis
- 24:26Outro
related talks
19mSandbox to confidential containers: A brief on the evolution of container isolation
32mHacking the Cloud Native Renaissance: Lowering Risk of Kubernetes Adoption
35mCloud Native Security for the Rest of Us
21mSandboxing Node.js with CoreOS and Docker
34mCloud Native Security: A New Paradigm for a New World
29mSandbox for Agentic Application With Cloud Native Stack
53mFrom Secure Container to Secure Service
41mCloud Native Security For The Rest Of Us