Checking Your --privileged Container
summary
Shows that the --privileged flag effectively disables confines: containerd sets withAllCapabilities, mounts the host fs, rewrites read-only mounts, disables ASLR via /proc/sys/kernel/randomize_va_space, and lets a container change SELinux labels. Live demos also create cgroups to throttle memory and show a process killed when limits are hit. Recommends granting narrow capabilities like CAP_NET_BIND_SERVICE instead of CAP_SYS_ADMIN, and enforcing deployment controls with Kubernetes securityContext, PodSecurityPolicy or OPA/Gatekeeper.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:31Agenda
- 2:16What are containers
- 3:53Container runtimes
- 5:48Container security
- 6:30Capabilities
- 7:46Security Contracts
- 10:12Privileged Containers
- 10:39Single Flag
- 10:57Demos
- 11:37All Capabilities
- 12:44Demo
- 14:45Masked paths
- 23:24Admission controllers
- 23:56Wrapup
related talks
10mAre you Avoiding --privileged? (Q3)
33mContainers Security Layers and How Not to Break them
38mEverything you don't want to know about privileged containers
25mDrawing Lines in the Sand, or Running Unprivileged eBPF in Kubernetes
50mThe state of container security
26mContainers: Your Ally in Improving Security
23mSecurity in a containerized world
38mContainer Security, capabilities an seccomp profiles