How We Used Kubernetes to Host a Capture the Flag (CTF)
summary
Hosted CTF runs on GKE with a hybrid design: 10,000 precreated Services with predefined ClusterIPs mapping registration cookies to routes, and on‑demand pod deployments for actual player instances. Challenges live on single persistent Linux VMs per participant using setuid binaries and a Ruby upload service. Hardening includes NetworkPolicy to block metadata and outbound traffic, PodSecurityPolicy/resource limits, read‑only Container‑Optimized OS nodes and optional user namespaces/gvisor. Eight participants start, six reach the final root flag.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:08What is a CTF
- 5:00Single-machine CTF design
- 10:19Hosting CTF on Kubernetes
- 12:03Kubernetes CTF requirements
- 13:47Kubernetes CTF infrastructure
- 14:51Static vs automated deployments
- 16:16Hybrid scaling solution
- 18:03Shell access risks
- 19:29Resource exhaustion risks
- 21:15Container breakout prevention
- 23:03Cluster takeover risks
- 24:26API access blocking
- 25:37Results and achievements
- 26:44Key takeaways
- 27:48Try the challenge
- 28:14Q&A
related talks
44mCapture the Flag Wrap Up & Summary
29m"Oh my Pod: Lessons from building one of Australia's biggest CTFs"
38mCTF as a Service
13mKeynote: Learn by Hacking: How to Run a 2,500 Node Kubernetes CTF
23mCapture The Flag Summary + Wrap UpVirtual
01h 24mTutorial: Attacking and Defending Kube...
49mAttacking and Detecting Attacks on Kubernetes Clusters
43mKubernetes Security: Attacking and Defending Modern Infrastructure