Securing Containers by Breaking In

on YouTube ↗37m

" summary

Live hacks show real outcomes: outdated binaries lead to code execution (an ImageMagick RCE breaks out to run scripts and spawn a shell via netcat), Spring Data REST deserialization enables remote command execution, and multi‑stage builds remove build‑time secrets. Tooling demonstrated includes Snyk CLI for scanning/monitoring, hadolint for Dockerfile linting, and rebuilding images (with 20% fixed by rebuilds and 44% fixed by switching base image) actually reduces vulnerabilities. Practical fixes succeed during the demo.

AI-written summary · about

" chapters (10)

1. 0:00Container security basics
2. 2:24Minimal base images matter
3. 6:55Least privilege principle
4. 9:45OS vulnerabilities: find and fix
5. 15:18Container break-in risks
6. 23:13Dockerfile linters for security
7. 24:15Securing app dependencies
8. 31:23Multi-stage builds benefits
9. 34:54Recap and best practices
10. 36:18Q&A

" related talks

• 47mSecuring Containers By Breaking InSimon Maple · DevOps World | Jenkins World 2019 San Francisco
• 40mSecuring Containers by Breaking inBrian Vermeer · J-Fall Virtual 2020
• 35mSecuring Containers by Breaking InBrian Vermeer · Devnexus 2021
• 57mWhat vulnerabilities? Live hacking of containers and orchestratorsLewis Denham Parry · NDC Oslo 2019
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 52mSecuring Your Java Containers by Breaking InBrian Vermeer · Voxxed Days Bucharest 2024
• 47mLive Hacking: Breaking into Your Web AppBrian Vermeer · Heapcon 2019
• 46mLive hacking: Breaking into your Java web appBrian Vermeer · Devoxx Belgium 2019