Pathless First: Redefining Runc Container Security Against ProcFS-Based Attacks
Talkat KubeCon + CloudNativeCon + OpenInfra Summit + PyTorch Conference China 2026 · 2026-09-07..09-09·
summary
Covers ProcFS-based container escape attacks against runc (TOCTOU symlink hijacks and bind-mount escapes) and explains the Pathless Container Setup (PCS) approach that replaces ambient path resolution with a file-descriptor-centric design using Linux pathless mount APIs (fsopen, fsmount). Describes upstreaming PCS into runc and its deployment in public clouds, and shows how the approach mitigates nine known path-related runc CVEs and offers hardening practices for runtimes.
AI-written summary · about
