It’s 2018; Are My Containers Secure Yet?!
summary
Updates for 2018 show concrete wins not platitudes: runtimes add Docker Content Trust image signing and swarm mode automates CA rotation so certs actually rotate on large clusters, user namespaces reduce host-root blast radius, and default seccomp and apparmor profiles block common syscalls. Image scanners from Twistlock and aqua security find CVEs; projects like Griffis, Linux kit and Lib entitlements plus Kubernetes annotations let images declare sandboxing (creo) so secure-by-default tooling actually works in practice.
AI-written summary · about
chapters (6)
- 0:00Intro
- 4:38CONTAINERS AREN'T PERFECT Kernel isolation features continue to have CVES Hedging on lightweight virtualization has gained popularity (e.g. Hyper.sh, Intel Clear Containers) Docker and Kubernetes have added other elements to "containers" that require security awareness
- 13:14HOST SECURITY
- 17:36CONTENT SECURITY Containers images are an important part of a security
- 21:57RUNTIME SECURITY Wher security capabilities exist for container runtimes?
- 30:32SECURITY FUTURES Whar coming next? What improvements will enable better security for the future?
related talks
24mDon’t be a fail whale, secure your containers
47mContainer Security, Are You Doing It Wrong?
30mMaster the Container Security Model with
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
27mContainer Security Best Practices
37mA question of trust: When good containers go bad
33mKubernetes Security Jumpstart
50mRuntime Security for Containers