Making Containers Safer
Talkat Linux Security Summit North America 2019 · on Monday, 2019-08-19· at 10:50· Sapphire D, Hilton San Diego Bayfront·
summary
Describes concrete defenses and recent kernel work: running 18 distros across six architectures and building ~300 images daily, users count in the hundreds of thousands; shows CVE-2019-5736 is prevented by using user namespaces; demos a pragmatic prototype called shiftfs for UID/GID shifting and points to seccomp notify (merged in 5.0) for syscall mediation. Recommends avoiding privileged containers, details mount API, pidfds, safe_setid and keyring namespacing (5.3) as practical building blocks.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 5:17Terminology
- 6:50Previous Containers
- 15:20Bad CVS
- 17:06Security features
- 17:50Namespaces
- 20:16Seccomp
- 22:03Linux Security Summit
- 22:54New features
- 23:05Secum
- 26:28MakeNot
- 28:48Extended Cisco Filtering
- 30:27Stacking
- 31:18Idea
- 31:54Mount API
- 36:15keyring namespacing
- 36:50file descriptors
related talks
42mSecuring Filesystem Images for Unprivileged Containers
33mContainers Security Layers and How Not to Break them
45mSecuring Container Runtimes -- How Hard Can It Be?
31mYour Containers Aren’t Alone: Demystifying Container Isolation
50mThe state of container security
50mImproving Container Security with System Call Interception
47mContainer Security
14mYour Containers Aren’t Alone: Demystifying Container Isolation