Mathias Tausig

Turning Container security up to 11 with Capabilities

A compromised sidecar container sniffs traffic between your services. See the attack in action and learn the one setting that stops it cold.

Turning Container security up to 11 with Capabilities
#1about 8 minutes

Demonstrating a man-in-the-middle attack between containers

A proof-of-concept shows how a malicious container can sniff unencrypted traffic between other containers running on the same host.

#2about 5 minutes

Introducing Linux capabilities for granular privilege control

Traditional Unix permissions are an all-or-nothing model, whereas Linux capabilities split root privileges into distinct units for finer control.

#3about 4 minutes

Differentiating between file and process capabilities

Capabilities can be set on files to elevate privileges for specific binaries or on processes to reduce them, with the latter being key for containers.

#4about 3 minutes

Managing default container capabilities in Docker

Docker grants a default set of powerful capabilities to containers, which can be restricted using `cap-drop` and `cap-add` flags.

#5about 4 minutes

Securing deployments by dropping unnecessary capabilities

By dropping all capabilities and only adding back the essential ones, the man-in-the-middle attack is successfully prevented in both Docker and Kubernetes.

#6about 3 minutes

Using capabilities as a defense-in-depth measure

Limiting capabilities does not prevent an initial exploit but significantly reduces the potential impact and blast radius of a compromised container.

Related jobs
Jobs that call for the skills explored in this talk.

Team Lead DevOps (m/w/d)

Rhein-Main-Verkehrsverbund Servicegesellschaft mbH

Rhein-Main-Verkehrsverbund Servicegesellschaft mbH
Frankfurt am Main, Germany

Senior
Kubernetes
DevOps
+1

Matching moments

Leveraging containerization for improved security posture
38:31 MIN

Leveraging containerization for improved security posture

Kubernetes Security - Challenge and Opportunity

Security best practices for containers and Kubernetes
56:21 MIN

Security best practices for containers and Kubernetes

Microservices: how to get started with Spring Boot and Kubernetes

Securing container images and the software supply chain
09:22 MIN

Securing container images and the software supply chain

Security Challenges of Breaking A Monolith

Securing container images against common vulnerabilities
06:30 MIN

Securing container images against common vulnerabilities

Kubernetes Security Best Practices

Using containers to improve security and deployment
13:51 MIN

Using containers to improve security and deployment

DevSecOps: Security in DevOps

Why Dockerfile security is a critical foundation
06:06 MIN

Why Dockerfile security is a critical foundation

A practical guide to writing secure Dockerfiles

Analyzing the impact of a container vulnerability
26:26 MIN

Analyzing the impact of a container vulnerability

Security Challenges of Breaking A Monolith

Identifying common Kubernetes security vulnerabilities
20:26 MIN

Identifying common Kubernetes security vulnerabilities

Kubernetes Security - Challenge and Opportunity

Featured Partners

Related Videos

See all videos
Kubernetes Security - Challenge and Opportunity42:45

Kubernetes Security - Challenge and Opportunity

Marc Nimmerrichter

Kubernetes Security Best Practices23:08

Kubernetes Security Best Practices

Rico Komenda

Hacking Kubernetes: Live Demo Marathon46:36

Hacking Kubernetes: Live Demo Marathon

Andrew Martin

Docker exec without Docker29:16

Docker exec without Docker

Oliver Seitz

Supply Chain Security and the Real World: Lessons From Incidents24:47

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Compose the Future: Building Agentic Applications, Made Simple with Docker50:09

Compose the Future: Building Agentic Applications, Made Simple with Docker

Mark Cavage, Tushar Jain, Jim Clark & Yunong Xiao

A Hitchhikers Guide to Container Security - Automotive Edition 202421:49

A Hitchhikers Guide to Container Security - Automotive Edition 2024

Reinhard Kugler

101 Typical Security Pitfalls28:41

101 Typical Security Pitfalls

Alexander Pirker

Related Articles

View all articles
AG
Andre Braun, GitLab
Now is the time for industrialized software development
Now is the time for industrialized software development Recently, I received a letter from my car’s manufacturer alerting me to a recall. They had discovered a defective part and wanted to replace it. It was easily fixed, and I might have forgotten a...
Now is the time for industrialized software development
DC
Daniel Cranney
Dev Digest 198: 30 years of JS, In-Browser AI, How Attackers Abuse GenAI
Inside last week’s Dev Digest 198 . 🎂 30 years of JavaScript ⏰ How long is a JavaScript second 💻 Clean code in Angular 🤦‍♂️ AI makes different mistakes than humans 👨‍💻 In-browser and offline AI 🟠 Undocumented Hacker News features 🐋 DeepSeek censored...
Dev Digest 198: 30 years of JS, In-Browser AI, How Attackers Abuse GenAI
CH
Chris Heilmann
Dev Digest 138 - Are you secure about this?
Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of security. Enjoy! News and ArticlesGoogle Pixel phones t...
Dev Digest 138 - Are you secure about this?

From learning to earning

Jobs that call for the skills explored in this talk.

DevOps

DevOps

UnderDefense

Remote
Bash
Azure
React
Kafka
+16