Container Security, Are You Doing It Wrong?
summary
Containers are not virtual machines and are not a security boundary — runtimes using runc (Docker, Podman) had a real-world CVE class (“leaky vessels”), so assume image contents are public and mutable. Practical steps: do not run containers as root, use multi-stage builds to leave compilers and package managers out of final images, publish cryptographically signed images with SBOMs and cosign, scan registries with Anchore, TruffleHog, Twistlock/OpenSCAP/Nessus and enforce policies with Kyverno or OPA. Rebuild images at least every 24 hours.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 1:50What are containers and myths
- 8:15Why containers aren't VMs
- 10:40Building containers securely
- 13:28Threat modeling and hardening
- 17:01Low-hanging security practices
- 22:24Software supply chain security
- 35:03Advanced supply chain concepts
- 38:58CI/CD pipeline security
- 41:53Deployment and runtime security
- 45:23Attack strategies and further reading
related talks
27mContainer Security Best Practices
05mContainer Security Best Practices
26mThe 10 Container Security Tricks That (...)
48mContainer Security: It’s All About the Supply Chain
30mMaster the Container Security Model with
40mSecuring Containers on the High Seas
33mContainers Security Layers and How Not to Break them
37mIt’s 2018; Are My Containers Secure Yet?!