Runtime Security for Containers
summary
Shows how to add concrete defenses at three pipeline stages: use Snyk to scan pom.xml and flag transitive CVEs (top-10 base images often carry ~30 vulnerabilities), run hadolint on Dockerfiles to ban root and catch brittle shell one-liners, and deploy Falco as a privileged daemonset (ebpf or kernel module built via DKMS) to watch syscalls and Kubernetes audit logs. Falco emits real-time alerts (via Falco Sidekick) — it detects shells and suspicious file writes but does not enforce blocking.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:54DevOps
- 3:59Developer Loop
- 11:58Security topics
- 12:40Hands on Agenda
- 13:22Dependencies
- 27:22Falco Architecture
- 30:08EBPF demo
- 48:54Falcosidekick
related talks
41mIdentifying and Mitigating Cloud and Container Threats
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
38mOpen Source Security Tools for Kubernetes Applications
06mOpensource Container Security: A Brief Overview
30mMaster the Container Security Model with
24mDon’t be a fail whale, secure your containers
29mDetecting cloud and container threats
05mContainer Security Best Practices