Mathias Tausig
Turning Container security up to 11 with Capabilities
#1about 8 minutes
Demonstrating a man-in-the-middle attack between containers
A proof-of-concept shows how a malicious container can sniff unencrypted traffic between other containers running on the same host.
#2about 5 minutes
Introducing Linux capabilities for granular privilege control
Traditional Unix permissions are an all-or-nothing model, whereas Linux capabilities split root privileges into distinct units for finer control.
#3about 4 minutes
Differentiating between file and process capabilities
Capabilities can be set on files to elevate privileges for specific binaries or on processes to reduce them, with the latter being key for containers.
#4about 3 minutes
Managing default container capabilities in Docker
Docker grants a default set of powerful capabilities to containers, which can be restricted using `cap-drop` and `cap-add` flags.
#5about 4 minutes
Securing deployments by dropping unnecessary capabilities
By dropping all capabilities and only adding back the essential ones, the man-in-the-middle attack is successfully prevented in both Docker and Kubernetes.
#6about 3 minutes
Using capabilities as a defense-in-depth measure
Limiting capabilities does not prevent an initial exploit but significantly reduces the potential impact and blast radius of a compromised container.
Related jobs
Jobs that call for the skills explored in this talk.
Matching moments
01:22 MIN
Leveraging containerization for improved security posture
Kubernetes Security - Challenge and Opportunity
06:25 MIN
Security best practices for containers and Kubernetes
Microservices: how to get started with Spring Boot and Kubernetes
01:52 MIN
Securing container images and the software supply chain
Security Challenges of Breaking A Monolith
02:35 MIN
Using containers to improve security and deployment
DevSecOps: Security in DevOps
02:30 MIN
Securing container images against common vulnerabilities
Kubernetes Security Best Practices
05:08 MIN
Analyzing the impact of a container vulnerability
Security Challenges of Breaking A Monolith
01:35 MIN
Why Dockerfile security is a critical foundation
A practical guide to writing secure Dockerfiles
02:28 MIN
Overcoming the challenges of container-based infrastructure
Building Reliable Serverless Applications with AWS CDK and Testing
Featured Partners
Related Videos
42:45Kubernetes Security - Challenge and Opportunity
Marc Nimmerrichter
46:36Hacking Kubernetes: Live Demo Marathon
Andrew Martin
23:08Kubernetes Security Best Practices
Rico Komenda
29:16Docker exec without Docker
Oliver Seitz
21:49A Hitchhikers Guide to Container Security - Automotive Edition 2024
Reinhard Kugler
28:41101 Typical Security Pitfalls
Alexander Pirker
24:47Supply Chain Security and the Real World: Lessons From Incidents
Adrian Mouat
28:26Docker network without Docker
Oliver Seitz
Related Articles
View all articles
.png?w=240&auto=compress,format)
From learning to earning
Jobs that call for the skills explored in this talk.
Mittwald CM Service GmbH & Co. KG
Espelkamp, Germany
Intermediate
Senior
Linux
Docker
DevOps
Kubernetes
smartclip Europe GmbH
Hamburg, Germany
Intermediate
Senior
GIT
Linux
Python
Kubernetes
Friedrich Kicherer GmbH & Co. KG
Ellwangen (Jagst), Germany
Junior
Intermediate
Senior
GIT
Docker
JavaScript
iits-consulting GmbH
München, Germany
Intermediate
Go
Docker
DevOps
Kubernetes
SYSKRON GmbH
Regensburg, Germany
Intermediate
Senior
.NET
Python
Kubernetes
