Securing Container Runtimes -- How Hard Can It Be?
summary
Catalogue of real CVEs and fixes with code-level detail: kernel-side openat2 / resolve_in_root patches to stop path-traversal and reopen races, a Rust library with a C API that emulates openat2 for old kernels, and concrete incidents (2014 capability misconfiguration that let containers open / on the host, a 2016 race allowing access to host rootfs during join, and a recent runc overwrite exploit). Demos show prevented symlink races and forbidding reopen-for-write. Watch if wanting patches, APIs and migration path.
AI-written summary · about
chapters (4)
- 0:00Start
- 17:30Resolve in Route
- 20:03What Does the Interface Look like
- 21:32Demo of the Security Vulnerability
related talks
45mSecuring Container Runtimes -- How Hard Can It Be?
39mInsecure Containers? Continuous Defense Against Open Source Exploits
34mExploiting a Slightly Peculiar Volume Configuration with SIG-Honk
45mThe Container Escape Room: An Exploration of Container Escapes
40mSecuring Containers by Breaking in
45mMaking Containers Safer
39mSecure Path Operations and Libpathrs
47mSecuring Containers By Breaking In