Designing Secure Containerized Applications for Embedded Linux Devices
Talkat Embedded Linux Conference @ Open Source Summit North America 2022 · on Friday, 2022-06-24· at 12:00· Griffin Hall (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
A demo shows a simple C program that reads /dev/rtc via ioctl and how a careless docker run can expose a host secret file; static analysis and image scanning catch problems—trivy found 370 issues—and multi-stage builds shrink images from ~250 MB to ~5 MB and then to ~100 KB when statically linked. Recommended defenses include user namespaces, --device instead of --privileged, --cap-drop all with selective caps, seccomp/AppArmor profiles, image digests and signing, and immutable, updatable images.
AI-written summary · about
chapters (23)
- 0:00Intro
- 3:08DISCLAIMERS
- 4:46WHAT IS A CONTAINER?
- 6:28WHY CONTAINERS ON EMBEDDED?
- 8:42CONTAINER INFRASTRUCTURE
- 11:12SECURING THE CONTAINER IMAGE
- 12:17CREATE A MINIMAL CONTAINER IMAGE
- 14:09HANDS-ON: DEBIAN BASED IMAGE
- 15:33HANDS-ON: ALPINE WITH MULTI-STAGE BUILD
- 16:14HANDS-ON: STATICALLY LINKED BINARY
- 17:14CREATE AND RUN IMAGES YOU TRUST
- 20:14STATIC ANALYSIS TOOLS
- 21:18SECURITY SCANNING
- 23:26EASILY UPDATABLE
- 25:02SECURING THE CONTAINER EXECUTION
- 25:16RESTRICT CONTAINER PRIVILEGES
- 28:01DEVICE FILES INSIDE THE CONTAINER
- 29:22USERS INSIDE CONTAINERS
- 31:26HANDS-ON: ENABLING USER NAMESPACE
- 32:41HANDS-ON: USER NAMESPACE IN CONTAINERS
- 35:20RESTRICTING SYSCALLS
- 36:46MANAGING RESOURCE USAGE
- 37:31LINUX SECURITY MODULES
related talks
46mDesigning Secure Containerized Applications for Embedded Linux Devices
45mMaking Containers Safer
35mSecuring Containers by Breaking In
35mDocker Security
41mIdentifying and Mitigating Cloud and Container Threats
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
30mMaster the Container Security Model with
40mSecuring Containers by Breaking in