Improving Containers Isolation in Kubernetes
summary
Kubernetes cluster operators get a working tool that automates creation, distribution and binding of kernel security profiles: Security Profiles Operator records profiles with an eBPF-based recorder or audit logs, installs seccomp/SELinux/AppArmor across nodes via a daemonset, and mutates pod specs with a webhook; it packages profiles as signed OCI images and verifies signatures before install. Defaults expose over 400 syscalls vs nginx under 200, and the operator reduces that surface. Adobe scales it to multi-tenant, mixed-runtime clusters and upstreams fixes.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:03Container isolation motivation
- 3:54Security profiles
- 6:04Kubernetes security profiles
- 8:55Security profiles lifecycle
- 9:38Security Profiles Operator
- 13:35Operator architecture
- 16:45Profile CR examples
- 17:06Seccomp profile demo
- 19:53Recording profiles
- 21:18Nginx profile demo
- 24:58Composing profiles
- 26:05OCI image profiles
- 28:53Automatic security binding
- 29:35Adoption challenges
- 37:24Q&A
related talks
24mEnhancing Kubernetes with the Security Profiles Operator
32mSecuring Kubernetes Applications by Crafting Custom Seccomp Profiles
38mContainer Security, capabilities an seccomp profiles
29mLayers of Isolation in Kubernetes
14mYour Containers Aren’t Alone: Demystifying Container Isolation
31mAutomatic application hardening by leveraging container runtime behavior analysis
43mSandboxes, Seccomp, and Syscalls: Chasing Isolation in Kubernetes (Mark Manning)
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies