Securing Container Runtimes -- How Hard Can It Be?
summary
Container runtimes repeatedly allow host breakouts via path races, procfs “magic links” and symlink-exchange attacks that succeed in under a second and previously let processes overwrite host binaries. Enabling user namespaces blocks most of these CVEs. Kernel-side fixes include the new syscall openat2 (resolve flags) in 5.6; user-space mitigation is a Rust library (libpathoras) that emulates secure path resolution on older kernels. Workarounds like per-container binary copies or read-only bind mounts reduce but do not fully eliminate the attack surface.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:53Use Namespaces
- 2:29Container on X
- 4:20Parents Job
- 6:14Container on Time
- 7:07Container Security Bug
- 10:20The Problem
- 13:30Another Bug
- 16:19File Describing Reopening
- 19:28Sibling Exchange Attack
- 26:08Why a library
- 28:46Rust
- 38:18Next Steps
- 40:04Where can you get the stuff
related talks
29mSecuring Container Runtimes -- How Hard Can It Be?
45mMaking Containers Safer
47mContainer Security
25mTowards the Hardened Cloud-Native Cornerstone: Container Runtime Protection from Secur...
33mContainers Security Layers and How Not to Break them
30mPathless First: Redefining Runc Container Security Against ProcFS-Based Attacks
39mInsecure Containers? Continuous Defense Against Open Source Exploits
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads