Secure Pods

on YouTube ↗24m

" summary

Defines a "secure pod" as a sandboxed pod that uses a separate guest kernel to add a second security boundary so kernel bugs like Dirty COW require a hypervisor exploit to escape. Describes implementations: Kata Containers (lightweight VMs) and gVisor (user‑space kernel), notes memory and visibility overheads, and details real risks: the subPath symlink CVE, logging parser bugs (fluentd), and cluster metadata leaks. Experimental runtime selection via cri‑o/containerd annotations exists now; target is alpha in 1.12.

AI-written summary · about

" chapters (13)

1. 0:00Start
2. 2:10Threats from the outside
3. 2:49Why do we care?
4. 4:00Attack Surfaces
5. 5:03Attacks via the Kernel
6. 5:56Today: kernel isolation features
7. 9:28Sandboxes - Visor
8. 14:25TODO: Sandboxed storage
9. 16:37Attacks over the network
10. 17:36Network Policy
11. 18:09Attacks via system logs
12. 20:36Attacks via the Hardware
13. 23:20Get Involved!

" related talks

• 26mSecure Containers Deployments: Time for RefreshAriel Shuper · ContainerCon @ Open Source Summit North America 2022
• 19mSandbox to confidential containers: A brief on the evolution of container isolationAkash Gautam · ContainerDays Conference 2024
• 29mLayers of Isolation in KubernetesTim Allclair · KubeCon + CloudNativeCon China 2018
• 47mContainer SecurityDaniel Walsh · LISA18
• 35mThe Enemy Within: Running Untrusted Code with gVisorIan Lewis · KubeCon + CloudNativeCon China 2019
• 35mThe Enemy Within: Running Untrusted Code with gVisorIan Lewis · KubeCon + CloudNativeCon + Open Source Summit China 2019
• 23mSecurity in a containerized worldJessica Frazelle · Paris Container Day 2017
• 22mSandboxes all the way down - A hitchhiker's guide to platform...Tom DNetto · BSidesSF 2023