Container Security: So Many Options, Use Them All!
summary
Shows how Red Hat built four focused tools and why they matter: buildah for building minimal images (demo of multistage and in-container builds succeeds), podman for rootless local runs using user namespaces and inherited login UIDs, skopeo to copy and inspect images between stores without pulling, and cri-o as a Kubernetes-only runtime enforcing read-only filesystems and knobbed-down Linux capabilities. CI example cites ~50 GitHub repos gated by containerized OpenShift builds and the demos demonstrate the tools working end-to-end.
AI-written summary · about
chapters (17)
- 0:00Start
- 1:48Overview
- 2:20Linux Namespaces
- 3:35Why Are Containers So Popular
- 7:38Build a Container Image
- 11:15Multistage Docker File
- 11:50Multistage Build
- 12:37Ci for Openshift
- 13:55Build inside a Container
- 15:55User Name Spaces
- 20:26Namespace Mappings
- 20:57User Name Spaces as Routes
- 26:17Help Menu
- 28:24Cryo
- 28:48Read-Only File System
- 29:52Disabling Linux Capabilities
- 31:23Cryo in Read-Only Mode
related talks
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
46mA Security State of Mind: Continuous Security with Kubernetes
05mContainer Security Best Practices
30mMaster the Container Security Model with
43mPodman, Buildah, Skopeo, and CRI-O A Year Later
26mContainerization crossroads: Experiences-Experiments-Expectations
47mContainer Security, Are You Doing It Wrong?
35mThe 10 steps of Container Security: It's not that hard !