The Runtime Rodeo; Where Open Source Image Behavior Is Tamed
summary
Proposes a cryptographically verifiable runtime behavioral fingerprint for container images, built from eBPF kernel telemetry and emitted as a runtime fingerprint YAML alongside images; RAD catalog already baselines ~50 images and aims for the top 500, runs baselines in CI/GitHub actions and a future CI GitHub action to catch deviations early. Prototype ebpf agent and drift algorithm detect a reverse shell in demo, version-to-version diffs surface unexpected outbound connections, and LLMs summarize anomalies.
AI-written summary · about
chapters (10)
- 0:00Runtime supply chain security
- 3:31Gaps in supply chain tools
- 7:29Runtime behavior verification
- 10:22Building behavioral fingerprints
- 13:30RAD catalog evolution
- 16:42Analyzing open source image behavior
- 20:11Collaboration with maintainers
- 22:41Expanding image coverage
- 24:32Verification mechanism roadmap
- 27:24Q&A
related talks
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
36meBPF for Runtime Security
41mIdentifying and Mitigating Cloud and Container Threats
20mSecuring CI/CD Runners Through eBPF
20mZero-Configuration Runtime Software Component Detection
24mRuntime Security: Challenges & Solution Space
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
09mBuilding an Agent Runtime With Open Infrastructure