Protecting Sensitive Code with Encrypted Container Images on...
summary
Prototype encrypts OCI image layers, pushes encrypted blobs plus per-recipient wrap key entries, and runs decryption on node side via containerd so registry need not be trusted. Kubernetes gains a new secret type imageDecryptSecret (service-account-compatible) that kubelet passes to CRI/containerd, which decrypts on pull; unauthorized pulls fail with a missing private key error. Spec change adds a +enc media type and layering keeps large base layers unencrypted so deduplication and single-layer sharing still work.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:36Container Image Encryption
- 14:21Encryption Primer - Symm Enc.
- 15:08Encryption Primer - Assym Enc.
- 15:51Encrypt and distribution flow
- 17:57OCI Proposal
- 19:25Container Encryption Features
related talks
32mProtecting Sensitive Code with Encrypted Container Images on...
33mDon't Peek Into my Container!
29mConfidential Containers: The Next Era of Cloud Data Security
24mProtecting Sensitive Data in Container Checkpoints
23mKubernetes + Encrypted Memory = Security * Privacy
50mConfidential Containers: Why, How, and Where Are We?
36mContainer Images & Security 101: 5 Need to Know Facts
25mSecuring Container Image Root File System on the Kubernetes Worker Nodes