Attack of the mutant tags!
summary
Mutable image tags cause concrete failures: a race-condition demo shows Kubernetes scheduling two pods with the same tag but different digests after uncordoning a node, so clusters run mixed versions. The fix built is a mutating admission controller (OPA + an image scanner) that replaces tags with image digests and annotates the pod, preventing TOCTOU bypass. Registry-side surprises include Harbor quirks where deleting a tag deletes manifests by digest and garbage collection cannot reclaim space because past manifests are retained.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:45Registry, image, container
- 3:19Image tag, manifest, layer...
- 5:30What is a mutant tag
- 8:59Mutant tag: use cases
- 10:35docker run
- 12:15Kubernetes pod schedule
- 22:11Every layer is a content addressable blob
related talks
30mEstablishing Image Provenance and Security in Kubernetes - Adrian Mouat, Container Solutions
33mKubernetes Security Jumpstart
24mReenforce Kubernetes Image Isolation in Multi-Tenant Service
36mModifying the Immutable: Attaching Artifacts to OCI Images
41mKubernetes Security Jumpstart
32mKubernetes Attack and Defense: Inception-Style
20mUsing, and mis-using K8s Dynamic Admission Control
21mHow to Not Destroy Your Production Kubernetes Clusters