On the Security of Copying To and From Live Containers
Talkat KubeCon + CloudNativeCon North America 2019 · on Wednesday, 2019-11-20· at 15:20· Room 11AB - San Diego Convention Center, Upper Level·
summary
Survey of copy implementations across Docker, Podman and Kubernetes shows concrete attacks: a Docker copy exploit POC loads container-controlled shared libs during a helper process and achieves full host access; Podman symlink resolution leads to host-file writes via race; kubelet uses an in-container tar binary enabling tar path‑traversal and symlink escapes to overwrite host files. Demonstrations include process trees and a breakout binary that mounts host FS. Fixes tested: sanitizing tar paths, forcing library loads early, and a suggested move to openat2 plus minimal namespace entry.
AI-written summary · about
chapters (16)
- 0:00Container copy security risks
- 2:09How containers work
- 6:00CP command vulnerabilities
- 6:43Podman symlink vulnerability
- 8:08Docker symlink race condition
- 9:54Docker partial entry risks
- 11:22Worst CP vulnerability
- 13:33Demo: Docker host compromise
- 15:45Demo: Filesystem takeover
- 18:06Kubernetes CP flaws
- 19:08Kubernetes path traversal issue
- 22:00Kubernetes symlink escape
- 23:46Kubernetes fixes response
- 25:30Future of Kubernetes CP
- 26:11Secure CP practices
- 27:33Kernel-level safety with openat2
related talks
52mA Wander Through the World of Container Security
45mSecuring Container Runtimes -- How Hard Can It Be?
34mExploiting a Slightly Peculiar Volume Configuration with SIG-Honk
29mSecuring Container Runtimes -- How Hard Can It Be?
43mA Compendium of Container Escapes
41mEscaping Virtualized Containers
35mContainers Attack and Defense
47mContainer Security