Is All Executable Code Added to a Container Image at Build Time? (Q2)
summary
Claim: all code must land in the image at build time so scanners catch it. Demonstration builds a Docker image, runs a runtime script that installs packages, then commits the running container; image drift appears when the committed image contains an old bash with CVE from 2014 (Shellshock). Using trivi to scan the built image shows no issues but scanning the committed runtime image finds high‑severity vulnerabilities, proving runtime installs evade build‑time gates.
AI-written summary · about
chapters (4)
- 0:00Intro
- 1:53Is all executable code added to a container image at build time?
- 2:40Treat containers as immutable
- 4:57Demo
related talks
30mMaster the Container Security Model with
35mSecuring Containers by Breaking In
47mSecuring Containers By Breaking In
37mSecuring Containers by Breaking In
47mContainer Security, Are You Doing It Wrong?
41mDesigning Secure Containerized Applications for Embedded Linux Devices
41mIdentifying and Mitigating Cloud and Container Threats
38mSo. Many. Vulnerabilities. Why are containers such a mess...