Bringing Containers to Enterprise
summary
Demonstrates concrete controls added to Mesos: user namespaces that map container UID 0 to a nonroot host UID (demo maps root to host 1002 and confirms UID map file), a POSIX capabilities isolator that lets operators whitelist net_admin so ping fails when not granted, and Seccomp profiles that block calls like sleep and kill; capabilities are upstream, seccomp and userns patches are under review, filesystem sharing and subuid/subgid handling remain the main unresolved limits.
AI-written summary · about
chapters (4)
related talks
45mMaking Containers Safer
38mUnderstanding root inside and outside a container
50mThe state of container security
24mBuilding containers is fun. Let's see how?
35mThe Reality of Rootless Containers
25mIsolate the Users! Supporting User Namespaces in K8s for Increased Security
54mUnderstanding user namespaces
30mThe Route To Rootless Containers