Entitlements: Understandable Container Security Controls
summary
Proposal defines a small set of human-readable container entitlements implemented in Docker as libentitlement, with an example running dockerd using three entitlements instead of --privileged and mapping down to capabilities/namespaces at runtime, not requiring users to learn kernel internals. Images can embed entitlements and be signed into a trusted bundle so publishers ship a security profile. Kubernetes integration is via admission controller or extended securityContext to inherit image entitlements, aiming to end blanket privilege and reduce 40+ capability confusion.
AI-written summary · about
chapters (8)
- 0:00The complexity of security
- 4:26Introducing entitlements
- 6:52Platform and image integration
- 11:08Goals and standard practices
- 14:08Future goals and scope
- 16:56Demonstrating the proposal
- 21:24Kubernetes and implementation
- 24:18Advanced tools and conclusion
related talks
50mInsights in Container Security
23mSecurity in a containerized world
40mSecuring Containers on the High Seas
33mContainers Security Layers and How Not to Break them
05mContainer Security Best Practices
48mContainer Security: It’s All About the Supply Chain
28mContainer Security: A Horror Story
46mSecuring Applications and Pipelines on a Container Platform