Securing Applications and Pipelines on a Container Platform
summary
Explains that containers share a host kernel so isolation depends on concrete controls not buzzwords and demonstrates namespaces and cgroups for process and resource isolation, SELinux/MCS and capabilities to limit escapes, and seccomp profiles to block syscalls. Shows build-time controls: image signing and registry scanning (Podman/Quay scanners) and pipeline hooks for continuous CVE checks. Covers application controls like network policies and mTLS via service mesh and platform egress IPs for firewalling.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:05Containers vs Virtualization
- 11:20Less Control Groups
- 15:20Linux Capabilities
- 18:42System Calls
- 25:05Private registries
- 27:19Responsibilities
- 33:26Scanning Tools
- 34:07PolicyBased Governance
- 36:32Security Policies
- 38:37Application Level Security
related talks
05mContainer Security Best Practices
14mYour Containers Aren’t Alone: Demystifying Container Isolation
40mSecuring Containers on the High Seas
47mContainer Security
23mSecurity in a containerized world
33mContainers Security Layers and How Not to Break them
31mYour Containers Aren’t Alone: Demystifying Container Isolation
34mHow to Contain Security in your Containers