~/talk

Digging Into Your App's Container Image Layers for Sneaky Vulnerabilities

on YouTube 26m
Talkat KubeCon + CloudNativeCon Europe 2022 · 2022-05-16..05-20· [security, devops-and-delivery]

speaker

name:Pablo Galego
links:none on file

resources

video:https://youtu.be/Yxh3MBRDVBU
slides:none on file

summary

Uses Trivy to scan a Spring Boot image (initial run shows ~200 vulnerabilities) and narrows to actionable items with --severity=CRITICAL and --ignore-unfixed, then uses wagoodman’s dive layer explorer to pinpoint the exact Docker layer that copies a vulnerable xstream jar brought in by a Helm plugin from the builder stage. Demonstrates using mvn dependency:tree and effective-pom to confirm it’s not in the source, shows multi-stage Dockerfile pitfalls, leaking build-time secrets via ARG misuse, and fixing issues by updating base images or plugin versions.

AI-written summary · about

chapters (5)

  1. 0:00Start
  2. 1:37The story behind this
  3. 5:02Keep in mind
  4. 6:48Playground
  5. 23:12Conclusions

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.