Automatic application hardening by leveraging container runtime behavior analysis
summary
An automated pipeline records container runtime behavior with eBPF-based tools, generates native Kubernetes policies (seccomp profiles, NetworkPolicy, AppArmor and securityContext), and applies them in CI/CD. The system claims a practical 80% reduction in reported vulnerabilities by filtering SBOMs to only loaded code, produces per-app seccomp from observed syscalls, and blocks unauthorized network and syscall actions in demos. It works but requires comprehensive test coverage and extra CI resources to avoid overstrict breaks.
AI-written summary · about
chapters (11)
- 0:00Application hardening intro
- 1:05Kubernetes Native policies
- 3:13Reducing blast radius
- 3:35Vulnerability challenges
- 6:25Function-level filtering fails
- 9:57Preventing container escapes
- 14:11Network policies for lateral movement
- 16:15Automating policies in CI/CD
- 17:19Live demo: policy generation
- 23:59Approach caveats and advantages
- 27:08Q&A
related talks
21mHow containers make security and compliance instantly easier
27mAutomating the DoD Container Hardening Pipeline
24mRuntime Security: Challenges & Solution Space
30mPod Security as an Afterthought
53mProtect Containerized Applications With System Call Profiling
26mMulti-layer hardening in Kubernetes
50mRuntime Security for Containers
25mProtecting Modern Workloads with eBPF superpowers