On the Way to Safe Containers
summary
LXD builds system containers that combine user namespace isolation with apparmor, seccomp, dropped capabilities, filesystem quotas and cgroups to aim for VM-like safety; live demos show CPU, memory, swap, disk and qdisc network limits applied live, snapshots and live migration working across hosts. Known limits are global kernel resources — inotify handles (512), routing table entries (millions during a 15,000-container CTF), ptys and uid map conflicts — which allow DoS of the host though no escapes are reported on recent kernels. Checkpoint/restore works but needs extra LSM handling and refinements.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:49What is LXI
- 3:57Security
- 5:34Resource Limits
- 8:58Global Limits
- 13:34Checkpoint Restore
- 18:49Demo
- 25:18Restore Containers
- 29:51Recap
related talks
45mMaking Containers Safer
50mImproving Container Security with System Call Interception
32mUsing a Different LSM from the Host in a Container
47mContainer Security
48mState of Linux Kernel Container Features
24mBuilding containers is fun. Let's see how?
33mContainers Security Layers and How Not to Break them
50mThe state of container security