WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2023 • Sep 27, 2023

Turning Container security up to 11 with Capabilities

Mathias Tausig

Are default container permissions exposing your internal traffic to rogue images? Discover why dropping all Linux kernel capabilities is the ultimate way to shrink your blast radius.

Pause
Mute Enter Fullscreen
#1 about 4 min

Identifying single-host container network vulnerabilities

Unencrypted HTTP traffic between isolated containers creates potential attack vectors on a local host.

#2 about 3 min

Building a proof of concept container deployment

Docker Compose establishes a frontend and backend architecture with an auxiliary health check.

#3 about 4 min

Executing a containerized man-in-the-middle attack

A malicious image sniffs unencrypted communication between containers running on the same host.

#4 about 5 min

Moving from all-or-nothing root access to capabilities

Linux kernel capabilities split administrative privileges into targeted categories for granular access control.

#5 about 4 min

Managing file and process permissions with capability boundaries

Command line tools like filecap and pscap inspect and manage granular process permissions across the system.

#6 about 2 min

Evaluating default capabilities assigned by Docker runtimes

Analyzing the extensive list of permissions granted to standard containers reveals the danger of using privileged modes.

#7 about 2 min

Enforcing container security with capability allow-list approaches

Dropping all default capabilities and appending only essential ones enforces the principle of least privilege.

#8 about 4 min

Finding essential application capabilities through trial and error

Testing container execution failures accurately identifies required permissions like chown and setuid.

#9 about 1 min

Blocking container spoofing attacks by removing raw network access

Dropping the raw network capability successfully prevents ARP spoofing and malicious container sniffing.

#10 about 2 min

Applying capability constraints in Kubernetes pod specifications

Configuring security contexts in Kubernetes limits the blast radius during an exploit to enforce defense in depth.

#11 about 2 min

Discussing sidecar attacks and transport layer security limitations

Unencrypted traffic handled by sidecar containers introduces security gaps between standard components and mesh proxies.

Matching moments

4:27 min

Identifying software vulnerabilities and typical configuration weaknesses

Marc Nimmerrichter · World Congress 2022

2:40 min

Discussing container privilege escalation and volume security risks

Andrew Martin · World Congress 2022

4:02 min

Applying tactical security configurations to Docker container layers

Madhu Akula · LIVE

3:21 min

Restricting container privileges using capability and seccomp profiles

Marc Nimmerrichter · World Congress 2022

6:01 min

Handling container constraints and fileless malware

Dimitrij Klesev +1 · LIVE

5:59 min

Live demonstration of vulnerability exploitation and zero trust mitigation

Jan Peer Stöcklmair Jan Peer Stöcklmair · World Congress 2026 Europe

More from World Congress 2023

The year 3000, a brief history of Web Development thumbnail
25:30
over 2 years ago

The year 3000, a brief history of Web Development

Lorenzo Pieri

Demografie nutzen um jedem Bewerber das passende Angebot zu machen! thumbnail
8:52
almost 3 years ago

Demografie nutzen um jedem Bewerber das passende Angebot zu machen!

Nathalie Gierth

Guided Memory Management: Rust's Ownership Model thumbnail
0:18
almost 3 years ago

Guided Memory Management: Rust's Ownership Model

Stefan Baumgartner

Passwordless future: WebAuthn and Passkeys in practice thumbnail
32:32
almost 3 years ago

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Building Reliable Serverless Applications with AWS CDK and Testing thumbnail
25:18
almost 3 years ago

Building Reliable Serverless Applications with AWS CDK and Testing

Raphael Manke

Related videos

Kubernetes Security - Challenge and Opportunity thumbnail
42:45
World Congress 2022 • over 4 years ago

Kubernetes Security - Challenge and Opportunity

Marc Nimmerrichter

Hacking Kubernetes: Live Demo Marathon thumbnail
46:36
World Congress 2022 • over 4 years ago

Hacking Kubernetes: Live Demo Marathon

Andrew Martin

Docker exec without Docker thumbnail
29:16
World Congress 2024 • about 2 years ago

Docker exec without Docker

Oliver Seitz

Kubernetes Security Best Practices thumbnail
23:08
World Congress 2025 • about 1 year ago

Kubernetes Security Best Practices

Rico Komenda

Enhancing Workload Security in Kubernetes thumbnail
44:00
LIVE • over 4 years ago

Enhancing Workload Security in Kubernetes

Dimitrij Klesev, Andreas Zeissner

A practical guide to writing secure Dockerfiles thumbnail
42:25
LIVE • over 5 years ago

A practical guide to writing secure Dockerfiles

Madhu Akula

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.