Lotsa security - confining the extra security layer
summary
Kata Containers adds host‑side SELinux confinement by shipping a new container_kvmt policy and wiring label propagation through CRI runtimes and the OCI spec. Implementation details: policy landed in containers‑policy, runtime uses go‑selinux to set labels, containerd bug is fixed by relying on libselinux, and KVM/Firecracker work is done. Cloud Hypervisor requires an API change to pass file descriptors which is implemented and pending merge. Demos show virtiofsd and VMM processes running as container_kvmt and pods booting; remaining work: kata‑deploy, virtiofsd alternatives and optional AppArmor support.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:05How it works
- 7:33What's SELinux
- 17:44Debugging containerd
- 20:44Fixing containerd
- 23:51Understanding the issue
- 24:54The Cloud Hypervisor workflow
- 25:30The Cloud Hypervisor REST API limitations
- 26:31The work on Cloud Hypervisor
- 27:14The work on Kata Containers
- 29:38What's still missing
- 30:27The benefits to the community
- 31:13Quick recap
related talks
47mContainer Security
38mImproving your Kubernetes Workload Security
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime
22mKata Containers: Security and Containers Without Compromise
53mFrom Secure Container to Secure Service
14mA kernel? In a Container? Explain Yourself!
36mKata Containers: Hypervisor-Based Container Runtime
35mKata Containers: Getting Involved with the Kata Community - Anne Bertucio & Samuel Ortiz