Everything you don't want to know about privileged containers
summary
Builds a container from about 100 lines of C using clone, namespaces and cgroups, runs the same actions in Docker and in Kubernetes, and escalates a privileged Kubernetes container to host root by flipping a YAML flag (0 → 1). Uses Falco to read kernel syscalls and alert—shows file creation, shell spawn, deleted history and even docker ps from inside the compromised container—proofs work live and Falco detects syscalls in all three cases.
AI-written summary · about
chapters (10)
- 0:00Introduction and setup
- 2:15Talk overview and background
- 6:07Understanding containers basics
- 13:08Containers and the kernel
- 21:19Live container hacking demo
- 27:15Docker container security risks
- 28:59Kubernetes privileged container exploit
- 32:14Falco detection in Kubernetes
- 34:26Security warnings and solutions
- 36:20Q&A session
related talks
52mA Wander Through the World of Container Security
24mChecking Your --privileged Container
49mContainers without Docker
31mTowards unprivileged container builds
18mKeynote: Running with Scissors
14mOrchestrate This! Kubernetes Rootkit
14mcontainerd: Rootless Containers 2020
33mContainers Security Layers and How Not to Break them