~/talk

Rootless containers

on YouTube 44m
Talkat DevConf.CZ 2019 · 2019-01-25..01-27· [security]

speakers

name:Giuseppe Scrivano
links:none on file
name:Akihiro Suda
github:AkihiroSuda

resources

video:https://youtu.be/jMOHfCw0DV8
slides:none on file

summary

Explains how containers run without root by combining user namespaces with a userspace network stack and a FUSE-backed overlay: fuse-overlayfs provides layered images for deduped storage, slirp4netns gives NATed network access, and a patched datapath claims up to 28.2 Gbps in optimized setups (and ~90 Mbps in simpler modes). Demonstrations show Podman/Buildah rootless workflows, Kubernetes as Usernetes proof-of-concept, and notes remaining limits: cgroups v2, remapping quirks, and extra cleanup for leaked mounts.

AI-written summary · about

chapters (4)

  1. 0:00Start
  2. 12:09Namespaces
  3. 23:08Advantages of Using Overlay as a Root
  4. 32:47Installation Modes

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.