Protecting Sensitive Code with Encrypted Container Images on...
summary
Build-time encryption of container layers uses a symmetric blob plus per-recipient wrap keys so the same encrypted layer can be shared and still grant different viewers access by uploading different wrap keys. Runtime integration pushes an ImageDecryptSecrets Kubernetes secret (service-account attachable) down to kubelet and containerd which decrypts layers with a streaming cipher on first pull. Spec work adds a +enc media type and layer-level annotations; key rewrapping enables adding recipients without changing layer hashes.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:51Registry
- 1:32Scenario
- 6:05Demo
- 12:54Thank you
- 14:07Deep Dive
- 14:21Symmetric Encryption
- 15:07Asymmetric Encryption
- 15:49What we do
- 16:25The symmetric key
- 17:19The private key
- 17:57OCI spec changes
- 19:24Encryption on layers
- 21:33Wrap up
- 26:49Resources needed
related talks
32mProtecting Sensitive Code with Encrypted Container Images on...
23mKubernetes + Encrypted Memory = Security * Privacy
33mDon't Peek Into my Container!
29mConfidential Containers: The Next Era of Cloud Data Security
29mBase64 is not encryption...
24mProtecting Sensitive Data in Container Checkpoints
25mSecuring Container Image Root File System on the Kubernetes Worker Nodes
30mTrust No One: Secure Storage With Confidential Containers