In this workshop, we’re going to write to the host’s filesystem from inside of a container using a shared mountpoint. This is a good tactic to gain persistence, but also to escalate privileges or ...
Seccomp 101 The lowest level of our container stack is the operating system on the host. These resources are accessed by any process in the operating system (a container or not) by system calls (...
What capabilities do I have? Capabilities define what a process is allowed to do. Instead of an all-or-nothing approach of either being root with all the permissions or a user with nothing, capab...
Our shared kernel One of the fundamental tenants of containers is that they’re a process that shares a kernel’s resources. It is not a virtual machine. Let’s try something together … $ docker r...
To start, let’s get an idea of how isolated we really are. Let’s run a few popular containers with a shell. We want to determine who we are inside our container, not outside of it (yet). This in...
This is dedicated to the person who asked me about this after a conference talk earlier this summer. Having found a great build job script injection to a privilege escalation … there was nothing e...
When you run docker pull image it 🪄 magically 🪄 pulls the right architecture. Right? Hi, I’m Natalie - the technical lead for public sector at Chainguard. As noted earlier, we use Sigstore a lot! ...
The rise of software supply chain attacks, strengthened security requirements of compliance frameworks, and the speed and complexity of software development have all driven the need for enterprise ...
One of the most common (and sneaky) misconceptions I run across talking to folks using containers is what even is a container? It seems like we’re slinging around little appliances or little VMs. T...
“Let’s move to containers” promised engineering simplicity, security, and easy scaling … but there was a catch. 🙊 The simplicity and security gains were only true if containers were used as intend...