Securing Container Image Root File System on the Kubernetes Worker Nodes
summary
Describes using upcoming hardware Memory Protection & Encryption features to prevent host administrators from reading container root filesystems on Kubernetes worker nodes. Explains limitations of current containerd image extraction and proposes changing the image-pull/extraction workflow so container image rootfs can remain protected in memory, with a demo of the approach.
AI-written summary · about
chapters (4)
related talks
42mSecuring Filesystem Images for Unprivileged Containers
23mKubernetes + Encrypted Memory = Security * Privacy
32mRoot Without Risk: A Decade-Long Quest for True Container Isolation
32mProtecting Sensitive Code with Encrypted Container Images on...
14mcontainerd: Rootless Containers 2020
32mProtecting Sensitive Code with Encrypted Container Images on...
31mTowards unprivileged container builds
33mContainers Security Layers and How Not to Break them