Container Security, capabilities an seccomp profiles
summary
Explains concrete demos with podman and Kubernetes showing that adding CAP_NET_BIND_SERVICE via runtime flags works for non-root containers but ambient capabilities are not supported in Kubernetes so the same cap fails there; adding file capabilities to the binary fixes the failure. Uses the Security Profiles Operator to record syscalls and produce a seccomp JSON, installs it clusterwide and applies it to pods, and shows the recording captures the missing syscalls so the tightened profile then allows the real workload to run.
AI-written summary · about
chapters (7)
- 0:00Introduction and speakers
- 1:10Linux capabilities overview
- 10:18Demo capabilities in containers
- 18:11Secure computing profiles
- 23:07Capabilities in Kubernetes
- 30:53Seccomp profiles in Kubernetes
- 35:49Security standards and Q&A
related talks
50mThe state of container security
32mSecuring Kubernetes Applications by Crafting Custom Seccomp Profiles
24mEnhancing Kubernetes with the Security Profiles Operator
42mImproving Containers Isolation in Kubernetes
23mSecurity in a containerized world
44mA deep dive into container security on AWS
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies
33mContainers Security Layers and How Not to Break them