Unpacking Open Source Security in Public Repos & Registries
summary
Scans cover ~44,000 container images from ~180 registries, ~2,000 git repos and ~164,000 YAML/Helm files and compare a general sample to CNCF graduated projects using cubescape and Grype-based scans. Graduated projects show fewer reported vulnerabilities but many findings are negligible, noisy or false positives (protobuf misreport from Grype); a BusyBox flaw appears in ~37,000 images yet is rarely exploitable. Using an eBPF sniffer to filter in-memory packages cuts reported vulns dramatically (nginx 400→4). Configuration checks show 35% vs 38% failed controls (graduated vs general), with missing resource limits and readiness probes as the top issues.
AI-written summary · about
chapters (10)
- 0:00Start
- 5:14'Container image scans
- 7:32Image tags with most scans in the graduated sample
- 8:22Comparison
- 11:07TOP vulnerabilities in general population
- 19:15TOP vulnerabilities in graduated projects
- 22:43Image vulnerability relevancy
- 24:58Explaining the numbers
- 27:00Most failed in general population
- 30:27Percent of controls failing
related talks
16mUnpacking Open Source Security in Public Repos
35mUnpacking Open Source Security in Public Repos & Registries
51mWhat We've Learned From Scanning 10K+ Kubernetes Clusters
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
30mWhat We've Learned from Scanning 10K+ Kubernetes Clusters - Gal Gibli
20mHow Secure is Your Base Image? ...
32mA Security State Of Mind: Compliance and ...
34mWhat We Learned Dissecting the World's Most Popular Containers