Building containers is fun. Let's see how?
summary
Live demo shows Docker plus libcap and systemtap producing a reproducible hard rule: dropping all capabilities breaks httpd because it lacks CAP_SETUID, CAP_SETGID and CAP_NET_BIND_SERVICE (three capabilities added back lets the container bind and serve). Cgroups demo sets memory to 10 MB and a stress test fails at 12 MB but succeeds at 8 MB. User namespace remap via subordinate uid/gid and docker daemon.json runs mysql inside the container as uid mysql while mapping to a safe host uid.
AI-written summary · about
chapters (6)
- 0:00Intro
- 0:15Starting a container
- 5:40Trace a process
- 9:48Start a container
- 15:00Namespaces
- 19:05Longterm solution
related talks
50mThe state of container security
38mBringing Containers to Enterprise
38mOn the Way to Safe Containers
31mWhat’s under the hood of Docker?
45mMaking Containers Safer
31mLet's Build And Break A Container By Hand Without Docker Or LXC
33mContainers Security Layers and How Not to Break them
24mChecking Your --privileged Container