Can You Prevent Container Drift? (Q6)
summary
Demo shows runtime enforcement stopping added executables: an nginx container has a one‑line shell script injected to simulate drift, an Aqua proprietary drift prevention profile first logs the action in audit mode detects and then, when flipped to enforce mode blocks, returns permission denied and prevents the new binary from running. Claim: profiling normal executables per image lets you detect and stop live code insertion without altering the image build pipeline.
AI-written summary · about
chapters (3)
related talks
53mProtect Containerized Applications With System Call Profiling
26mContainers: Your Ally in Improving Security
43mThe Power of Application Intent Analysis for Container Security [I]
46mSecuring Applications and Pipelines on a Container Platform
30mFinding Imposter Among Us: Container Edition
41mIdentifying and Mitigating Cloud and Container Threats
47mContainer Security, Are You Doing It Wrong?
45mThe Container Escape Room: An Exploration of Container Escapes