Mathias Tausig
Turning Container security up to 11 with Capabilities
#1about 8 minutes
Demonstrating a man-in-the-middle attack between containers
A proof-of-concept shows how a malicious container can sniff unencrypted traffic between other containers running on the same host.
#2about 5 minutes
Introducing Linux capabilities for granular privilege control
Traditional Unix permissions are an all-or-nothing model, whereas Linux capabilities split root privileges into distinct units for finer control.
#3about 4 minutes
Differentiating between file and process capabilities
Capabilities can be set on files to elevate privileges for specific binaries or on processes to reduce them, with the latter being key for containers.
#4about 3 minutes
Managing default container capabilities in Docker
Docker grants a default set of powerful capabilities to containers, which can be restricted using `cap-drop` and `cap-add` flags.
#5about 4 minutes
Securing deployments by dropping unnecessary capabilities
By dropping all capabilities and only adding back the essential ones, the man-in-the-middle attack is successfully prevented in both Docker and Kubernetes.
#6about 3 minutes
Using capabilities as a defense-in-depth measure
Limiting capabilities does not prevent an initial exploit but significantly reduces the potential impact and blast radius of a compromised container.
Related jobs
Jobs that call for the skills explored in this talk.
ROSEN Technology and Research Center GmbH
Osnabrück, Germany
Senior
TypeScript
React
+3
Matching moments
03:17 MIN
Selecting strategic partners and essential event tools
Cat Herding with Lions and Tigers - Christian Heilmann
04:57 MIN
Increasing the value of talk recordings post-event
Cat Herding with Lions and Tigers - Christian Heilmann
04:49 MIN
Using content channels to build an event community
Cat Herding with Lions and Tigers - Christian Heilmann
01:32 MIN
Organizing a developer conference for 15,000 attendees
Cat Herding with Lions and Tigers - Christian Heilmann
02:54 MIN
Automating video post-production with local scripts
Cat Herding with Lions and Tigers - Christian Heilmann
04:57 MIN
Developing resilience by expanding your capacity for failure
What 2025 Taught Us: A Year-End Special with Hung Lee
03:38 MIN
Balancing the trade-off between efficiency and resilience
What 2025 Taught Us: A Year-End Special with Hung Lee
03:39 MIN
Breaking down silos between HR, tech, and business
What 2025 Taught Us: A Year-End Special with Hung Lee
Featured Partners
Related Videos
42:45Kubernetes Security - Challenge and Opportunity
Marc Nimmerrichter
46:36Hacking Kubernetes: Live Demo Marathon
Andrew Martin
29:16Docker exec without Docker
Oliver Seitz
23:08Kubernetes Security Best Practices
Rico Komenda
24:47Supply Chain Security and the Real World: Lessons From Incidents
Adrian Mouat
21:49A Hitchhikers Guide to Container Security - Automotive Edition 2024
Reinhard Kugler
50:09Compose the Future: Building Agentic Applications, Made Simple with Docker
Mark Cavage, Tushar Jain, Jim Clark & Yunong Xiao
28:41101 Typical Security Pitfalls
Alexander Pirker
Related Articles
View all articles
From learning to earning
Jobs that call for the skills explored in this talk.
AllatNet Recruiting GmbH & Co. KG
GIT
Azure
Linux
DevOps
Docker
+8
SAP AG
Sankt Leon-Rot, Germany
Junior
Go
Azure
DevOps
Puppet
Docker
+6
Passion for People GmbH
Karlsruhe, Germany
Remote
€70-90K
Azure
DevOps
Gitlab
+10
SVA System Vertrieb Alexander GmbH
Remote
DevOps
Ansible
Terraform
Kubernetes
Cloud Solutions
Frankfurt am Main, Germany
Go
Bash
Rust
Linux
Shell
+6