Lightning Talk: lockc - Containing the Containers That Do Not Contain
summary
lockc is an open source MAC-style enforcement agent (Rust + C, moving to pure Rust) that attaches eBPF programs to eBPF LSM hooks via Aya to enforce per-container policies at the kernel level. It detects runc containers, stores container ID→policy in BPF maps, and blocks actions like preventing bind mounts, hiding host-like pseudo-filesystems, denying kernel syslog access, and forbidding container root logins. Demo on k3s shows a root-running nginx image is blocked while a non-root image starts successfully.
AI-written summary · about
chapters (7)
related talks
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
07mLightning Talk: Enhancing Runtime Protection Leveraging Compliance Frameworks
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
30mFinding Imposter Among Us: Container Edition
37mSandboxing Applications with Landlock
21mArmoring Cloud Native Workloads With LSM Superpowers
40mLandlock Config
32mLinux Sandboxing with Landlock