Securing Containers By Breaking In
summary
Live demos show an exploitable ImageMagick flaw delivering an ImageTragick RCE by uploading a crafted image that fetches and executes a shell, a netcat reverse shell proves full command execution inside the container, and a URL‑encoded payload performs directory traversal against the st package to read /etc/passwd. Scans with snick scan surface that top Docker Hub images each have 30+ vulns (Node example cited ~580), 44% of images drop risk by switching base image and 1-in-5 shrink vuln count by a simple rebuild, so use multistage builds, nonroot users, signing and linters.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:06Cloud Native
- 5:12Base Image
- 7:05Choosing a Base Image
- 14:39Verified Images
- 16:25OS Vulnerability Scanning
- 18:14Docker Vulnerability Scanning
- 19:12Image Magic Vulnerability
- 20:50Image Magic
- 25:39Halo Lint
- 30:43Application Vulnerability
- 32:57Open Source Vulnerability
- 39:38Multistage Build
- 41:59Questions
related talks
40mSecuring Containers by Breaking in
35mSecuring Containers by Breaking In
37mSecuring Containers by Breaking In
49mVulnerability Exploitation In Docker Container Environments
46mStranger Danger: Securing Your Java Containers by Breaking In
30mMaster the Container Security Model with
32mSecure containers - Michael Wager and Michael Helwig
52mSecuring Your Java Containers by Breaking In