The state of container security
summary
Shows working demos and concrete proposals: container runtimes ship with 14 default capabilities but many apps need far fewer; dropping CAP_NET_RAW breaks ping, and a live demo records a container needing ~25 syscalls then blocks LS -l when enforcing. Explains a seccomp BPF hook that traces syscalls to build per-image profiles and a proposal to embed those profiles in images, plus rootless podman and user-namespace mapping, shifting filesystems and containers.conf for distro/admin defaults — prototypes, PRs and limitations are named.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 6:00Container security limits
- 11:17Running containers as root
- 16:48Dropping capabilities demo
- 23:30SELinux with volumes
- 26:00Seccomp to limit syscalls
- 31:37Rootless containers benefits
- 34:50User namespace isolation
- 39:05Containers.conf defaults
- 48:34Q&A
related talks
38mContainer Security, capabilities an seccomp profiles
23mSecurity in a containerized world
45mMaking Containers Safer
26mContainers: Your Ally in Improving Security
33mContainers Security Layers and How Not to Break them
53mProtect Containerized Applications With System Call Profiling
46mSecuring Applications and Pipelines on a Container Platform
26mExploring Container Mechanisms Through the Story of a Syscall