WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Feb 24, 2022

Enhancing Workload Security in Kubernetes

Dimitrij Klesev , Andreas Zeissner

Think your read-only file systems stop advanced threats? Learn how to defeat fileless malware using kernel-level protections like Seccomp and the Security Profiles Operator in Kubernetes.

Pause
Mute Enter Fullscreen
#1 about 4 min

Introduction to Kubernetes security context configurations

Pod and container specifications can be configured to restrict capabilities, users, and file system access.

#2 about 4 min

Restricting system calls with Seccomp profiles

Applying the least privilege principle mitigates exploits by explicitly denying unnecessary system calls to the kernel.

#3 about 5 min

Extending mandatory access control with AppArmor

AppArmor enables mandatory access control to restrict file access and process isolation across containers sharing a volume.

#4 about 6 min

Tightening the security perimeter using SELinux

SELinux acts as kernel middleware to enforce fine-grained access contexts between subjects and objects.

#5 about 3 min

Automating policies via the Security Profiles Operator

The Security Profiles Operator automates the deployment and management of security module bindings using unified YAML configurations.

#6 about 6 min

Deploying manual Seccomp profiles to block malware

Simulating fileless malware execution in memory demonstrates the necessity of denying specific memory allocation system calls.

#7 about 4 min

Automating Seccomp rules with operator profile bindings

Profile bindings allow administrators to apply Seccomp rules globally without managing static files locally on every node.

#8 about 10 min

Troubleshooting SELinux container permission denials live

Generating custom SELinux policies live helps resolve application directory access denials and permission errors.

#9 about 7 min

Handling container constraints and fileless malware

Audience questions cover granular AppArmor constraints, fileless malware execution techniques, and eBPF as modern kernel middleware.

Matching moments

1:39 min

Introduction to Kubernetes security challenges and opportunities

Marc Nimmerrichter · World Congress 2022

1:19 min

Securing Kubernetes workloads and containerized image layers

Aleksandr Kalikov · LIVE

1:54 min

Applying capability constraints in Kubernetes pod specifications

Mathias Tausig · World Congress 2023

52 sec

Mitigating container escalation paths using system call filters

Reinhard Kugler · LIVE

4:40 min

Assessing common Kubernetes security incidents and misconfigurations

Rico Komenda Rico Komenda · World Congress 2025

11:32 min

Audience questions on security, limitations, and Kubernetes crossover

Maurice Brinkmann · LIVE

More from WeAreDevelopers LIVE

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
5 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
10 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail
1:04:42
11 days ago

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail
48:06
18 days ago

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres thumbnail
7:41
19 days ago

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres

Chris Heilmann, Daniel Cranney

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
about 1 month ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 2

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate, Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 15:30–16:00

Mainstage

One Boundary for the Agentic Era

Mark Lechner

Chief Information Security Officer, Dokcer

Mark Lechner
Open session

World Congress 2026 North America

September 25, 2026 · 12:30–14:30

Stage 11

Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes

Kristiyan Velkov

Front-End Advocate | Speaker | AI & DevOps | Docker Captain | Cursor Ambassador | DevReal | Tech Blogger | Book Author

Kristiyan Velkov
Open session

World Congress 2026 North America

September 24, 2026 · 15:30–16:00

Stage 9

Run your agents in Kubernetes: Build once, deploy anywhere. But really?

Michal Salanci

Senior Systems Engineer at ESET Cybersecurity

Michal Salanci
Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 8

Docker's Agentic Platform: Sandboxes, MCP, and the Infrastructure of Autonomous Development

Oleg Å elajev

AI and Developer relations at Docker

Oleg Å elajev

Related videos

Kubernetes Security - Challenge and Opportunity thumbnail
42:45
World Congress 2022 • about 4 years ago

Kubernetes Security - Challenge and Opportunity

Marc Nimmerrichter

Kubernetes Security Best Practices thumbnail
23:08
World Congress 2025 • about 1 year ago

Kubernetes Security Best Practices

Rico Komenda

Turning Container security up to 11 with Capabilities thumbnail
28:47
World Congress 2023 • almost 3 years ago

Turning Container security up to 11 with Capabilities

Mathias Tausig

Hacking Kubernetes: Live Demo Marathon thumbnail
46:36
World Congress 2022 • about 4 years ago

Hacking Kubernetes: Live Demo Marathon

Andrew Martin

A practical guide to writing secure Dockerfiles thumbnail
42:25
LIVE • over 5 years ago

A practical guide to writing secure Dockerfiles

Madhu Akula

From Build to Breach: Hacking Kubernetes Through the Supply Chain thumbnail
31:38
World Congress 2026 Europe • about 2 months ago

From Build to Breach: Hacking Kubernetes Through the Supply Chain

Ali Alp

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.