Container & Kubernetes Security workshop

This workshop highlights the critical importance of integrating security early in container and Kubernetes environments, demonstrating how vulnerabilities lead to system compromise 1:38-2:29.

Key Takeaways:
• Attackers use tools like Shodan to find exposed services and brute-force credentials to gain initial access to management interfaces like Weave Scope 7:04-10:16.
• Misconfigurations such as mounted Docker sockets allow attackers to break out of containers, access the host filesystem, and establish persistence using reverse shells 14:46-18:56.
• Containers rely on Linux namespaces for isolation, but files and processes running inside are still visible on the host system 30:58-36:42.
• Running containers as non-root users limits potential damage, ensuring compromised processes do not immediately have full root access to the host 36:43-42:34.
• Privileged containers allow direct access to kernel files and host settings, creating significant security risks that require careful detection and management 45:28-51:13.

The session provides foundational knowledge for securing containerized applications by understanding common attack vectors and implementing defense-in-depth strategies.

Sources:

• 1:38 Introduction to container and community security
• 7:04 Finding exposed services and brute-forcing Weave Scope
• 14:46 Container breakout and persistence mechanisms
• 30:58 Explaining container isolation and filesystem access
• 36:43