Towards the Hardened Cloud-Native Cornerstone: Container Runtime Protection from Secur...
summary
Containers still show frequent kernel and runtime CVEs and a Tencent Cloud chart reports container escape among top user concerns and 7% of users running with no security. The work examines concrete mitigations: Landlock rule sets for unprivileged file sandboxing, core scheduling to limit HT-based side channels, CPU features IBT and shadow stacks for control flow protection, and hardware-backed approaches like Memory Protection Keys and confidential containers (SGX process and VM-based) with attestation, image encryption and runtime adaptations to enforce privacy and reduce TCB.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:52Container Security Risks (Users' View)
- 2:14(Extended) Container Threat Modeling
- 3:11Container Attack Vectors (Attackers' View)
- 4:15Container Attack Scenarios (AS)
- 5:29Any Best Practice?
- 5:53What Do We Have So Far?
- 6:58What Else Can We Apply?
- 8:04Not Enough Security Deployment!
- 8:56Weaknesses (Still) Across Every Layer!
- 10:57Unprivileged Sandboxing
- 12:07Sandboxing Containers with Landlock
- 14:13Defend Against Cross-HT Attacks
- 16:08Containers with Core Scheduling
- 17:13Can Hardware Assist?
- 19:25An Augmented Threat Model
- 20:34Secure - Confidential Containers
- 22:11Gaps From A Bird's Eye View
- 23:23A Further Augmented Threat Model?
related talks
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
27mContainer Security Best Practices
41mIdentifying and Mitigating Cloud and Container Threats
45mSecuring Container Runtimes -- How Hard Can It Be?
45mMaking Containers Safer
14mYour Containers Aren’t Alone: Demystifying Container Isolation
40mCloud Native Security: A New Paradigm for a New World
05mContainer Security Best Practices