What Should and Shouldn’t Scare You: Kubernetes and Containers
summary
Kubernetes standardizes images with content-addressable images (SHA-256 digests) and exposes a discoverable API that lets you audit running workloads; concrete surprises include every Chick‑fil‑A running a three‑node cluster (roughly 6,000 federated deployments) and that most clusters inspected lack network policies and run many containers as root. Container escapes often come down to one dangerous flag that disables containment; practical controls are admission‑controller enforcement and real‑time blocking workflows that reject bad images or configs before they deploy.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:49What this talk covers
- 4:49Building blocks of Kubernetes
- 8:37Container escapes and isolation
- 10:42Immutable infrastructure benefits
- 11:46Standard APIs and security
- 14:21Leaky abstractions risks
- 15:44Defaults and security gaps
- 16:48Enforcement workflows
- 17:51Dev and security alignment
- 18:33Community security approach
related talks
28mContainer Security: A Horror Story
43m6 Strategies to Bring Order to Kubernetes Security Disruptions
33mKubernetes Security Jumpstart
41mKubernetes Security Jumpstart
35mKubernetes Security - Challenge and Opportunity?
28mKubernetes Security Low-Hanging Fruit
19mKubernetes Security: Navigating the Real-World Challenges
40mContainers, Kubernetes and Practical DevSecOps