Unpacking Open Source Security in Public Repos & Registries
summary
Research analyzes Kubescape scans aggregated into the Armo platform from 60–70k clusters, ~40M Kubernetes objects and ~178 registries, comparing a general sample to CNCF graduated projects. Findings: misconfigurations are widespread (91% containers run as root vs 83% in graduated projects; immutable root FS fails 97% vs 92%; service-account token automount 81% vs 69%) and average control failures per resource are ~38% (general) vs ~35% (graduated). Image scans show fewer real risks after a relevancy filter removes ~80% of reported vulns by excluding packages not loaded at runtime; Go-based projects retain more relevant findings.
AI-written summary · about
chapters (6)
- 0:00Introduction and speaker background
- 3:11Research methodology and data overview
- 5:21Workload configuration analysis
- 17:09Container image vulnerabilities comparison
- 27:11Key findings and security recommendations
- 30:42Q&A session
related talks
34mUnpacking Open Source Security in Public Repos & Registries
16mUnpacking Open Source Security in Public Repos
51mWhat We've Learned From Scanning 10K+ Kubernetes Clusters
23mWhat We've Learned from Scanning 10K+ Kubernetes Clusters
30mWhat We've Learned from Scanning 10K+ Kubernetes Clusters - Gal Gibli
18mWhat We've Learned from Scanning 10K+ Kubernetes Clusters
10mLightning Talk: What Have We Learned from Scanning Over 10K Unique Clusters with Ku...
19mKubernetes Security: Navigating the Real-World Challenges