Containers Security Layers and How Not to Break them
summary
Containers run with kernel features to isolate and limit privileges and the risk of escape rises sharply when run as privileged; mounting the host filesystem or adding users lets an attacker get root or install kernel modules. Use precise controls: capabilities via --cap-drop/--cap-add, seccomp with a custom profile (Docker offfers ~44 syscalls blocked of ~300 by default), AppArmor profiles and cgroups for CPU/memory limits. Profile apps (use a gen proof) and trigger all functionality before deploying.
AI-written summary · about
chapters (13)
- 0:00Start
- 4:22Run with Low Privileges
- 4:49Does Containers Have Limited Functionalities
- 6:27Privilege Mode
- 9:58Capabilities
- 14:56Secure Computing Mode
- 21:32Recommendation
- 23:04C Groups
- 25:08Namespaces
- 26:07Create Isolation
- 26:51Docker Default Namespaces
- 28:18Recommendations
- 29:22Takeaways
