Secure containers - Michael Wager and Michael Helwig
summary
Shows a live Node.js command‑injection exploited to get a reverse shell from a Docker Hub node:16 image, then rebuilds with distroless using a multi‑stage Dockerfile and removes shells and package managers so spawning sh fails. Scans with Trivy drop from 238 findings (221 high, 17 critical) to 2 findings (0 critical, 2 high). Notes required fixes: copy missing shared libraries discovered with ldd into the distroless runtime, use a debug tag (busybox) for CI debugging, and expect compatibility and debugging tradeoffs.
AI-written summary · about
chapters (8)
- 0:00Introduction to secure containers
- 1:04Security challenges with base images
- 5:24Component reduction methods
- 7:54Live hacking demo
- 14:22Research on container security
- 18:36Advantages and challenges
- 22:30Conclusion and recommendations
- 24:57Q&A session
related talks
47mSecuring Containers By Breaking In
35mSecuring Containers by Breaking In
40mSecuring Containers by Breaking in
37mSecuring Containers by Breaking In
57mBreaking and Fixing your ‘Docker’ ized environments
39mInsecure Containers? Continuous Defense Against Open Source Exploits
41mIdentifying and Mitigating Cloud and Container Threats- 41mIdentifying and Mitigating Cloud and Container Threats