WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2023 • Sep 27, 2023

Turning Container security up to 11 with Capabilities

Mathias Tausig

Are default container permissions exposing your internal traffic to rogue images? Discover why dropping all Linux kernel capabilities is the ultimate way to shrink your blast radius.

Pause
Mute Enter Fullscreen
#1 about 4 min

Identifying single-host container network vulnerabilities

Unencrypted HTTP traffic between isolated containers creates potential attack vectors on a local host.

#2 about 3 min

Building a proof of concept container deployment

Docker Compose establishes a frontend and backend architecture with an auxiliary health check.

#3 about 4 min

Executing a containerized man-in-the-middle attack

A malicious image sniffs unencrypted communication between containers running on the same host.

#4 about 5 min

Moving from all-or-nothing root access to capabilities

Linux kernel capabilities split administrative privileges into targeted categories for granular access control.

#5 about 4 min

Managing file and process permissions with capability boundaries

Command line tools like filecap and pscap inspect and manage granular process permissions across the system.

#6 about 2 min

Evaluating default capabilities assigned by Docker runtimes

Analyzing the extensive list of permissions granted to standard containers reveals the danger of using privileged modes.

#7 about 2 min

Enforcing container security with capability allow-list approaches

Dropping all default capabilities and appending only essential ones enforces the principle of least privilege.

#8 about 4 min

Finding essential application capabilities through trial and error

Testing container execution failures accurately identifies required permissions like chown and setuid.

#9 about 1 min

Blocking container spoofing attacks by removing raw network access

Dropping the raw network capability successfully prevents ARP spoofing and malicious container sniffing.

#10 about 2 min

Applying capability constraints in Kubernetes pod specifications

Configuring security contexts in Kubernetes limits the blast radius during an exploit to enforce defense in depth.

#11 about 2 min

Discussing sidecar attacks and transport layer security limitations

Unencrypted traffic handled by sidecar containers introduces security gaps between standard components and mesh proxies.

Matching moments

4:27 min

Identifying software vulnerabilities and typical configuration weaknesses

Marc Nimmerrichter · WWC 2022

2:40 min

Discussing container privilege escalation and volume security risks

Andrew Martin · WWC 2022

4:02 min

Applying tactical security configurations to Docker container layers

Madhu Akula · LIVE

3:21 min

Restricting container privileges using capability and seccomp profiles

Marc Nimmerrichter · WWC 2022

6:01 min

Handling container constraints and fileless malware

Dimitrij Klesev +1 · LIVE

5:59 min

Live demonstration of vulnerability exploitation and zero trust mitigation

Jan Peer Stöcklmair Jan Peer Stöcklmair · WWC Europe 2026

More from World Congress 2023

The year 3000, a brief history of Web Development thumbnail
25:30
over 2 years ago

The year 3000, a brief history of Web Development

Lorenzo Pieri

Demografie nutzen um jedem Bewerber das passende Angebot zu machen! thumbnail
8:52
over 2 years ago

Demografie nutzen um jedem Bewerber das passende Angebot zu machen!

Nathalie Gierth

Guided Memory Management: Rust's Ownership Model thumbnail
0:18
over 2 years ago

Guided Memory Management: Rust's Ownership Model

Stefan Baumgartner

Passwordless future: WebAuthn and Passkeys in practice thumbnail
32:32
over 2 years ago

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
over 2 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Building Reliable Serverless Applications with AWS CDK and Testing thumbnail
25:18
over 2 years ago

Building Reliable Serverless Applications with AWS CDK and Testing

Raphael Manke

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

Related videos

Kubernetes Security - Challenge and Opportunity thumbnail
42:45
WWC 2022 • about 4 years ago

Kubernetes Security - Challenge and Opportunity

Marc Nimmerrichter

Hacking Kubernetes: Live Demo Marathon thumbnail
46:36
WWC 2022 • about 4 years ago

Hacking Kubernetes: Live Demo Marathon

Andrew Martin

Docker exec without Docker thumbnail
29:16
WWC 2024 • almost 2 years ago

Docker exec without Docker

Oliver Seitz

Kubernetes Security Best Practices thumbnail
23:08
WWC 2025 • 12 months ago

Kubernetes Security Best Practices

Rico Komenda

Enhancing Workload Security in Kubernetes thumbnail
44:00
LIVE • over 4 years ago

Enhancing Workload Security in Kubernetes

Dimitrij Klesev, Andreas Zeissner

A practical guide to writing secure Dockerfiles thumbnail
42:25
LIVE • over 5 years ago

A practical guide to writing secure Dockerfiles

Madhu Akula

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.