Secure Substrate for Container Apps
summary
Docker stacks a secure substrate: LinuxKit builds a minimal, read-only OS with containerized system daemons and DM‑Verity block integrity; InfraKit provisions machines with declarative, rolling reverse uptime refreshes; runC/containerd provide namespaced execution and content‑addressable pulls; Notary adds threshold signing and survivable key rotation for image and OS hashes; SwarmKit enforces join tokens, mutual TLS with transparent root rotation and secrets kept only in memory — demo boots one worker, joins the swarm, and successfully deploys a stack. 12 whitelisted capabilities, 30‑minute cert lifetime
AI-written summary · about
chapters (9)
- 0:00Introduction to tetrominos
- 2:25Infrastructure with infrakit
- 4:56Building secure OS with linuxkit
- 9:04Secure runtime execution
- 11:41Supply chain with notary
- 13:29Cluster security with swarmkit
- 19:51Integrating the full stack
- 25:03Live demonstration
- 29:48Summary and conclusion
related talks
52mSafer Apps from Docker Security Building Blocks
37mIt’s 2018; Are My Containers Secure Yet?!
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
43mContainer Security: So Many Options, Use Them All!
33mContainers Security Layers and How Not to Break them
46mSecuring Applications and Pipelines on a Container Platform
40mSecuring Containers on the High Seas
14mcontainerd: Rootless Containers 2020