Living in a Secure Container Down by the River
Explore container security and isolation techniques in this conference talk from Derbycon 2018. Delve into the misconception of containers as sandboxes and learn about real-world workload isolation. Examine container isolation models using cgroups and namespaces, including Docker, Rkt, and LXC. Discover the Open Container Initiative (OCI) specification and its role in defining image and runtime attributes. Investigate advanced isolation methods such as gVisor user-space kernel and Kata Containers with hypervisor integration. Address implementation flaws like account reuse in Kubernetes and the importance of network policies. Learn about beneficial design patterns, including the No New Privileges flag and read-only containers. Gain insights into building effective security policies and understand the complexities of container isolation beyond runtimes.