Securing Containers by Breaking In
summary
Scans of popular Docker Hub images show every image contains known OS vulnerabilities and 44% of those are fixed by switching to a newer base; rebuilding fixes 20%. The demo runs Snyk container test to identify Debian-packaged issues, triggers an image magic RCE by uploading a crafted JPEG, and reduces a naive 600MB build to ~132MB using multi-stage builds and a slim runtime. Recommendations: pick minimal bases, run non-root users, lint Dockerfiles, scan and monitor images continuously.
AI-written summary · about
chapters (10)
- 0:00Introduction to containers
- 3:49Speaker introduction
- 5:15Why minimal base images matter
- 9:52Least privileged principle
- 12:22Scanning and monitoring images
- 20:07Demonstration of exploit
- 24:18Linting Dockerfiles
- 25:01Dependency vulnerabilities
- 26:27Multi-stage builds
- 29:17Summary and best practices
related talks
47mSecuring Containers By Breaking In
40mSecuring Containers by Breaking in
49mVulnerability Exploitation In Docker Container Environments
30mMaster the Container Security Model with
57mBreaking and Fixing your ‘Docker’ ized environments
35mDocker Security
37mSecuring Containers by Breaking In
25mMy Container Image has 500 Vulnerabilities, Now What?