[KCDSpain2021] Container Security, an introduction to capabilities an seccomp profiles

rael · June 8, 2021, 5:44pm

mvazquezc · June 9, 2021, 7:58am

Hola!

Dejo las slides por aquí:

Y las demos que se vieron en directo:

gist.github.com

https://gist.github.com/mvazquezc/bf5f129025f9c7f224ed1acb32c95c27

demo1.md

# Capabilities on Containers demos

## Demo 1 - Run a container and get its thread capabilities

1. Let’s run a test container, this container has an application that listens on a given port, but that’s not important for now:

    ~~~sh
    podman run -d --rm --name reversewords-test quay.io/mavazque/reversewords:latest
    ~~~
2. We can always get capabilities for a process by querying the /proc filesystem:

This file has been truncated. show original

demo2.md

# Seccomp on Containers demos

## Demo 1 - Create your own seccomp profile

1. We will use the [OCI Hook project](https://github.com/containers/oci-seccomp-bpf-hook) in order to generate the seccomp profile for our app
2. Create a container with the OCI Hook which runs our application:

    ~~~sh
    sudo podman run --rm --annotation io.containers.trace-syscall="of:/tmp/ls.json" fedora:32 ls / > /dev/null
    ~~~

This file has been truncated. show original

demo3.md

# Capabilities on Kubernetes demos

## Demo 1 - Pod running with UID 0 vs container running with nonroot UID

1. Create a namespace

    ~~~sh
    NAMESPACE=test-capabilities
    kubectl create ns ${NAMESPACE}
    ~~~

This file has been truncated. show original

There are more than three files. show original

Cualquier duda la podemos hablar por aquí!

rael · June 10, 2021, 8:42am

¡Muchas gracias @mvazquezc!

Topic		Replies	Views
[KCDSpain2021] Simplifying Kubernetes resource access control using RBAC impersonation Spanish kcdspain	2	1534	June 10, 2021
[KCDSpain2021] Introduction to Kubernetes Spanish kcdspain	2	1420	June 10, 2021
[KCDSpain2021] Desplegando aplicaciones ASP NET Core en kubernetes Spanish kcdspain	1	953	July 9, 2021
[KCDSpain2021] Prepárate para multi cloud con Crossplane Spanish kcdspain	2	1429	June 10, 2021
[KCDSpain2021] Abrazando el cambio: gobierno de Kubernetes como código con Gatekeeper Spanish kcdspain	1	793	June 14, 2021

[KCDSpain2021] Container Security, an introduction to capabilities an seccomp profiles

Related topics