In Containers We Trust? Building Trust in Containerized Environments
summary
Extends a hardware-to-container chain of trust by measuring container images at creation and mapping executable files during runtime, using IMA logs and TPM PCRs for non-repudiable evidence. Implements an eBPF program on the LSM in_map_file hook plus a loadable kernel module to tag measurements with a container identifier, producing Merkle-file hashes of image contents without host OS changes. Prototype works end-to-end; namespace granularity and IMA log scaling remain open.
AI-written summary · about
related talks
47mNamespacing the Linux Integrity Measurement Architecture
29mIMA Namespaces for Containers
29mZero-Trust Containers: Rethinking Security in the Age of Ephemeral...
30mFinding Imposter Among Us: Container Edition
36mOverview and Recent Developments: Linux Integrity
43mThe Power of Application Intent Analysis for Container Security [I]
35mEstablishing Container Trust at Scale [I]
42mSecuring Filesystem Images for Unprivileged Containers