Mathias Tausig
Turning Container security up to 11 with Capabilities
#1about 8 minutes
Demonstrating a man-in-the-middle attack between containers
A proof-of-concept shows how a malicious container can sniff unencrypted traffic between other containers running on the same host.
#2about 5 minutes
Introducing Linux capabilities for granular privilege control
Traditional Unix permissions are an all-or-nothing model, whereas Linux capabilities split root privileges into distinct units for finer control.
#3about 4 minutes
Differentiating between file and process capabilities
Capabilities can be set on files to elevate privileges for specific binaries or on processes to reduce them, with the latter being key for containers.
#4about 3 minutes
Managing default container capabilities in Docker
Docker grants a default set of powerful capabilities to containers, which can be restricted using `cap-drop` and `cap-add` flags.
#5about 4 minutes
Securing deployments by dropping unnecessary capabilities
By dropping all capabilities and only adding back the essential ones, the man-in-the-middle attack is successfully prevented in both Docker and Kubernetes.
#6about 3 minutes
Using capabilities as a defense-in-depth measure
Limiting capabilities does not prevent an initial exploit but significantly reduces the potential impact and blast radius of a compromised container.
Related jobs
Jobs that call for the skills explored in this talk.
Team Lead DevOps (m/w/d)
Rhein-Main-Verkehrsverbund Servicegesellschaft mbH
Frankfurt am Main, Germany
Senior
Featured Partners
Related Videos
42:45Kubernetes Security - Challenge and Opportunity
Marc Nimmerrichter
46:36Hacking Kubernetes: Live Demo Marathon
Andrew Martin
42:25A practical guide to writing secure Dockerfiles
Madhu Akula
44:00Enhancing Workload Security in Kubernetes
Dimitrij Klesev & Andreas Zeissner
30:33A solution to embed container technologies into automotive environments
Falk Langer & Lukas Stahlbock
40:00Local Development Techniques with Kubernetes
Rob Richardson
32:55Open Source Secure Software Supply Chain in action
Natale Vinto
43:39Reusing apps between teams and environments through Containers
Adrian Kosmaczewski
From learning to earning
Jobs that call for the skills explored in this talk.
DevOps Engineer – Kubernetes & Cloud (m/w/d)
epostbox epb GmbH
Berlin, Germany
Intermediate
Senior
DevOps
Kubernetes
Cloud (AWS/Google/Azure)
Ansible Docker Editeur Google Cloud KUBERNETES TERRAFORM
Silkhom
Bron, France
Remote
€50-65K
Senior
Bash
Azure
DevOps
+10
DevOps Security Engineer with Golang Development Focus (m/f/d)
SAP AG
Sankt Leon-Rot, Germany
Junior
Go
Azure
DevOps
Puppet
Docker
+6
100**Remote - Devops Engineer (m/w/d) Docker, Kubernetes, CI/CD
APRIORI - business solutions AG
Berlin, Germany
Kafka
DevOps
Docker
VMware
Kubernetes
+3