Finding Imposter Among Us: Container Edition
summary
Claims that qbarma/Cube Armor enforces inline enforcement via Linux Security Modules and uses eBPF probes for contextual telemetry, converts policies into AppArmor-like profiles, and demonstrably blocks an unauthorized binary from reading Vault data. Enforcement happens at kernel hook time rather than post-facto, and benchmarks on a Redis workload show overhead under 3%. Covers Seccomp/LSM tradeoffs, how container-level rules miss intra-container entities, and a live demo of denying access to a mounted secrets directory.
AI-written summary · about
chapters (10)
- 0:00Container runtime security intro
- 2:09Breaking down container runtime security
- 5:00Zero trust and Among Us
- 9:16Kernel events and eBPF detection
- 12:53Linux primitives for enforcement
- 15:41Cloud-native runtime security tools
- 16:25How Kubearmor enforces security
- 17:50Demo: Kubearmor in action
- 22:25Q&A: Kubearmor footprint
- 26:18Q&A: Pod secret access policies
related talks
45mThe Container Escape Room: An Exploration of Container Escapes
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
46mSecuring Applications and Pipelines on a Container Platform
25mProtecting Modern Workloads with eBPF superpowers
21mArmoring Cloud Native Workloads With LSM Superpowers
31mAutomatic application hardening by leveraging container runtime behavior analysis
50mThe state of container security
29mSecuring Secrets in K8s Environments