Insights in Container Security
summary
Containers share the host Linux kernel so a successful escape grants control of the host and every container on it; Docker intentionally strips many privileges but still exposes ~40 Linux capabilities to containers, leaving attack surface in syscalls and filesystems. The Docker engine exposes a Docker daemon REST API that must be TLS-authenticated and firewalled, and the default bridge lets containers talk unless network policies are applied. Use image provenance, avoid baking credentials into images, encrypt sensitive data, and apply defense‑in‑depth network zones and orchestration hardening.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:33About Nils Magnus
- 2:22Why Container Security
- 4:02History Quiz
- 5:16Container Security
- 9:21Isolation Features
- 14:20Threat Types
- 15:15Complex Attack Surface
- 16:23Linux Capabilities
- 19:25Issues with Capabilities
- 21:12Attack Surfaces
- 25:49Namespaces
- 31:32C Groups
- 32:30Architecture Issues
- 35:24Application Architecture
- 36:12Defense in Depth
- 38:21Network Security
- 40:09untrusted sources
- 41:43build your own images
- 43:28turning off security features
- 45:46summary
- 47:19questions
related talks
33mContainers Security Layers and How Not to Break them
14mDocker Security
43mDocker Security: Start your Container Journey Safely
35mDocker Security
34mHow secure are Docker containers?
47mContainer Security
49mVulnerability Exploitation In Docker Container Environments
24mDon’t be a fail whale, secure your containers