"Oh my Pod: Lessons from building one of Australia's biggest CTFs"
summary
Built a statewide two-day CTF that runs on Kubernetes with per-team namespaces, OpenVPN pods and shell boxes, handling 3600 containers across 190 namespaces and costing about AUD 600/day while using gvisor as a hardened runtime. Uses GitHub repos + private Docker registry to “bake” images from docker compose, converts to k8s, and enforces network policies to block access to the Kubernetes and cloud metadata APIs. Reports no container escapes, some challenge flakiness, and plans tighter resource limits and capability drops.
AI-written summary · about
chapters (10)
- 0:00Introduction and CTF background
- 6:18From shared containers to Kubernetes
- 14:18Hardening container security
- 20:51Kubernetes security recap
- 22:14Closing thoughts on Kubernetes
- 23:19Q&A on container escapes and issues
- 24:50Q&A on DNS spoofing and cloud providers
- 25:12Q&A on Kubernetes hosting and updates
- 26:16Q&A on Kubernetes challenges and testing
- 28:01Q&A on favorite challenges
related talks
30mHow We Used Kubernetes to Host a Capture the Flag (CTF)
13mKeynote: Learn by Hacking: How to Run a 2,500 Node Kubernetes CTF
38mCTF as a Service
44mCapture the Flag Wrap Up & Summary
39mHow to CTF Infra - Beyond the Challenges and Flags
23mCTF Overview and Experience
30mA secure journey on Kubernetes
38mThree Years of Lessons Running Potentially Malicious Code Inside Containers