CRI-O: Secure, Performant, and Boring...

on YouTube ↗21m

" summary

CRI-O now implements CRI v1 and stays version-locked with Kubernetes, fixed a CVE introduced in 1.19 that allowed arbitrary sysctl writes, and flips seccomp on by default in 1.24. A Rust replacement for conmon called conmon-rs (kanmon) uses capn proto IPC to reduce memory and add a streaming API; it runs containers and exec/attach in tests but isn’t production-ready yet. SELinux relabeling gets three strategies (always relabel, conditional skip with annotations, skip if privileged), runtime classes gain multiple storage drivers, and cosign and kubelet checkpointing (1.25) are coming.

AI-written summary · about

" chapters (11)

1. 0:00Start
2. 0:45What is CRI-O?
3. 1:47A Few Updates
4. 2:50Rethinking container lifecycle management
5. 9:45SELinux and Kubernetes: A Primer
6. 11:50The Problem: Volume Relabeling
7. 13:20Solution #1: Conditionally Skip if Correct
8. 14:45Solution #2: Always Skip if 'spc_t'
9. 15:31Efficiency vs Security
10. 16:56Enabling Seccomp by Default
11. 18:36Looking Forward

" related talks

• 38mIntroduction to CRI-OMrunal Patel, Peter Hunt · KubeCon + CloudNativeCon North America 2019
• 33mCRI-O Still Loves KubernetesMrunal Patel, Peter Hunt, Urvashi Mohnani, Sasha Grunert · KubeCon + CloudNativeCon Europe 2021
• 31mCRI-O: The Runtime Control RoomSascha Grunert, Mrunal Patel, Peter Hunt, Urvashi Mohnani · KubeCon + CloudNativeCon North America 2020 Virtual
• 40mCRI-O’s Senior YearMrunal Patel, Peter Hunt, Urvashi Mohnani · KubeCon + CloudNativeCon North America 2022
• 26mWhat's New in CRI-O?Sascha Grunert, Mrunal Patel, Peter Hunt, Urvashi Mohnani · KubeCon + CloudNativeCon North America 2021
• 46mCRI-O: All the Runtime Kubernetes needAntonio Mudarca · QCon São Paulo 2018
• 29mCRI-O: All the Runtime Kubernetes Needs, and Nothing MoreMrunal Patel · KubeCon + CloudNativeCon North America 2017
• 37mCRI-O: Under the HoodSascha Grunert, Mrunal Patel · KubeCon + CloudNativeCon North America 2019