Hacking the Cloud Native Renaissance: Lowering Risk of Kubernetes Adoption
summary
Nine years of container consulting yields concrete attack stories and mitigations: a dirty pipe container breakout that writes to root memory and spawns a reverse shell, supply‑chain compromises via infected dependencies and build pipelines, and cloud account takeover from leaked keys. Recommended controls include image scanning, pod security contexts and pod‑level network policy, IDS, artifact signing and reproducible builds, moving to workload identity instead of static creds, and next‑gen sandboxing with gVisor/firecracker for isolating untrusted code.
AI-written summary · about
chapters (6)
- 0:00Start
- 17:39Code to Cloud: Attack Patterns
- 20:47Supply Chain Attacks
- 21:15How to Attack a Supply Chain
- 22:15Open Source Tooling: Current and Emerging
- 29:16Hardening: Next Generation Sandboxing?
related talks
32mHow cloud-native applications are helping orgs stay ahead of cybersecurity threats
19mHacking Kubernetes
43mKubernetes Security: Attacking and Defending Modern Infrastructure
35mKubernetes Security - Challenge and Opportunity?
19mHow to Secure Your Kubernetes Clusters
58mTop Secret Cloud Native Security Lessons
38mA Treasure Map of Hacking (and Defending) Kubernetes
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era