Three Years of Lessons Running Potentially Malicious Code Inside Containers
summary
Katacoda runs public Docker/Kubernetes sandboxes for three years and reports concrete defenses and failures: attackers deploy crypto miners and render farms, cause CPU spikes to 100% and fork bombs that spawn ~7,000 processes. Mitigations that work are enforcing seccomp/AppArmor/capabilities and non-root or pids_limit to stop fork bombs, recycling long-running sessions, blocking egress with network policies/egress filters or CNI traffic shaping, using kernel packet filters for DDoS, and detecting abuse with Falco and process-level monitoring.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 3:26Core technologies
- 7:51Death threat model
- 10:36Left port open
- 13:02Miner pools
- 14:34Networking
- 17:55Serverless
- 19:11IPtables
- 21:34Packet filters
- 23:30Privileged containers
- 26:31Container Reporting
- 31:03Pit Limit
- 32:04Network Misuse
- 33:48Falco
- 34:58Containers Secure
- 35:42Summary
related talks
28mKubernetes Runtime Security: What Happens if a Container Goes Bad?
50mRuntime Security for Containers
45mThe Container Escape Room: An Exploration of Container Escapes
38mKubernetes Security: Attacking and Defending K8s Clusters
26mContainers: Your Ally in Improving Security
29mFrom Illuminating to Eliminating Crypto Jacking Techniques in Cloud Native
29mKubernetes Security: Attacking and Defending K8s Clusters
32mContainer Security: Exploits, Vulnerabilities and Defense