Rootless, Reproducible, and Hermetic: Secure Container Build Showdown
summary
Argues that rootless builds are now practical but each tool trades safety for usability, compares BuildKit, img, buildah, Kaniko, Makisu and others, and shows why an exposed Docker socket lets attackers escalate into CI fleets. Demonstrates a live demo attacking container build pipelines, describes Makisu’s Redis-backed distributed cache and BuildKit’s rootless/userns modes, and emphasizes reproducibility requirements for reproducible OCI images (pinned inputs, no network during runs). Releases kubeSec v2 static analysis.
AI-written summary · about
chapters (8)
- 0:00Introduction to trust
- 2:26Running as root in containers
- 5:04Reproducible builds and OCI
- 10:26Securing the build process
- 13:33Comparing build tools
- 23:37Future trends and takeaways
- 25:21Tools and resources
- 26:25Q&A session
related talks
43mContainer Security: So Many Options, Use Them All!
37mSecuring Containers by Breaking In
25mBuilding Docker Images Without Docker
34mUnprivileged Image Builds: What are the Challenges and Where are we Today?
14mcontainerd: Rootless Containers 2020
18mPractical End-to-End Container Security at Scale
30mMaster the Container Security Model with
14mAre Your Builds Running Separately from Your Production Cluster? (Q1)