Containers: Your Ally in Improving Security
summary
Runtime monitoring collects which paths are written, which kernel capabilities a process requests (via a BPF probe), and which TCP connects happen, then uses that data to generate deploy-time settings. A privileged daemonset sends file-write and cap_capable events to an analyzer; applying a read-only root filesystem with a single writable volume stops payload drops, drop Linux capabilities prevents chown-based escalation, and a deny-egress network policy prevents wget from fetching a crypto miner — the live exploit demo succeeds only before those protections.
AI-written summary · about
chapters (7)
- 0:00Introduction to containers
- 7:44Security opportunities with containers
- 14:03Runtime monitoring demo setup
- 15:55Read-only filesystem control
- 19:07Linux capabilities control
- 20:52Network policy control
- 22:57Summary and Q&A
related talks
50mThe state of container security
50mRuntime Security for Containers
41mIdentifying and Mitigating Cloud and Container Threats
33mContainers Security Layers and How Not to Break them
45mThe Container Escape Room: An Exploration of Container Escapes- 41mIdentifying and Mitigating Cloud and Container Threats
32mListen to your Engine
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces