Do Your Containers Even Lift – A Hardening Guide for K8s Containers
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 13:45· Level 1 | Hall Entrance S10 | Room D·
summary
Scans find secrets and high‑severity CVEs (studies cite ~28,000 images with secrets and >1M exposed components); the demo uses Trivy and Truffle Hog to show a Flask image with plaintext creds and a CVSS 8.8 vuln, then hardens it: mount build‑time secrets, add non‑root user, healthcheck, use pin image by digest, readonly rootfs, drop capabilities, apply seccomp and PodSecurity labels via Gatekeeper and Trivy operator. Result: no known vulnerable packages and a clean CIS workload benchmark.
AI-written summary · about
chapters (18)
- 0:00Container hardening intro
- 1:51Container security terms
- 9:21Vulnerable example container
- 11:28Scan Squishy Bin for issues
- 14:15Quick patching wins
- 16:01Secure K8s with namespaces
- 16:43Enforce pod security policies
- 19:11Admission controllers explained
- 22:05Hardening Dockerfile builds
- 23:28Pinning images to digests and resource limits
- 24:31Transform Squishy Bin to Catching
- 24:52Scan results before/after
- 25:58Scalable security program
- 27:21Security with dev workflows
- 28:45Security advocacy culture
- 30:06Tools and resources
- 31:07K8s security communities
- 31:51Q&A
related talks
24mDon’t be a fail whale, secure your containers
50mRuntime Security for Containers
24mSecuring Container Workloads
47mSecuring Containers By Breaking In
37mIt’s 2018; Are My Containers Secure Yet?!
30mMaster the Container Security Model with
41mIdentifying and Mitigating Cloud and Container Threats
30mA secure journey on Kubernetes