Designing Secure Containerized Applications for Embedded Linux Devices
summary
Practical steps to harden containerized apps for embedded Linux: build minimal images via multi‑stage and static linking (example: 250 MB → 5 MB → 100 KB using alpine then scratch image), pin by digest and sign with docker content trust, run cppcheck and Trivy scans, avoid --privileged and mount only /dev/rtc with --device, prefer user namespaces or non‑root, drop unnecessary capabilities (use cap drop all then add back what’s needed), apply a custom seccomp profile, limit cgroups memory/CPU, enable AppArmor and mount the root FS read‑only with tmpfs for writable state.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:26Agenda
- 3:02What Is a Container
- 12:12Securing the Container Image
- 13:28Mitigation Technique Create a Minimal Container Image
- 15:12What a Docker File Is
- 25:36How To Secure the Execution of a Container Image
- 27:16Remove this Privileged Flag
- 30:53Username Space
- 35:31Restricting Cisco
- 37:58Control Groups
- 38:34Linux Security Models
- 41:00Networking
related talks
41mDesigning Secure Containerized Applications for Embedded Linux Devices
35mDocker Security
33mContainers Security Layers and How Not to Break them
59mGetting Started with Embedded Linux Security
45mMaking Containers Safer
26mThe 10 Container Security Tricks That (...)
40mSecuring Containers on the High Seas
40m"Willy Wonka and the Secure Container Factory"