Container Security Workshop

Learn how to scan, secure and leverage properties in the Linux kernel like seccomp, namespaces, ccgroups to secure your docker containers.

Today is meant for anyone who has any exposure to containers, whether you have used them or not. We are going to start with a short overview (yes, slideware) and then we’ll get into the lab as soon as possible. That is where we will spend most of our time.

Have a discussion. This will be boring if it’s just us up here talking for over 4 hours. Participate. We are going to cut you loose with containers here in just a little while. Have questions. Have opinions. Hopefully you have your laptop with you. If not, please find a shoulder-surfing buddy. See? Not only can we dig into containers but you can make a new friend! Agenda

• Setup

• Exercise 1.0 - Intro to Cockpit

• Exercise 1.1 - Reproducible and Trustworthy Dockerfiles

• Exercise 1.2 - Docker `USER`

• Exercise 1.3 - Remove setuid/setgid Binaries

• Exercise 1.4 - CGroups

• Exercise 1.5 - Namespaces

• Exercise 1.6 - Read Only Containers

• Exercise 1.7 - Seccomp

• Exercise 1.8 - SELinux

• Exercise 1.9 - Linux Kernel Capabilities

• Wrap Up