Keynote: Running with Scissors
summary
Demonstrates a live single-node Kubernetes VM running a vanilla Nginx image from Docker Hub, showing that container root maps to host root, that 86% of images lack a USER line and run as root by default, and that setting privileged=true grants all Linux capabilities (allowing actions like changing the host name). Shows binding to port 80 requires extra capability so she rebuilds to run on 8080 as a non-root user, and proves a mounted host / lets a container write into kubelet’s static pod directory, enabling injection of a new control-plane pod.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:40run a an engine x container inside a pod
- 2:41processes that are running inside containers
- 10:46running as root inside a container
- 11:52mounting the root directory
- 16:49run your images as non-root users
related talks
52mA Wander Through the World of Container Security
15mKeynote: Kubernetes
54mThe Hacker’s Guide to Kubernetes
19mKeynote: Kubernetes: Simple to Manage Anywhere
48mThe Path Less Traveled: Abusing Kubernetes Defaults
38mEverything you don't want to know about privileged containers
38mA Treasure Map of Hacking (and Defending) Kubernetes
34mHijack a Kubernetes Cluster - a Walkthrough