In this talk Justin Cormack introduces a new system of security entitlements for container workloads. These specify the types of access a pod should have in a human readable way. He will also demonstrate an example implementation running in Kubernetes.
The current pod security configuration is very low level, and does not really make any sense to users of the system. How can we make security configuration understandable? One route comes from the model of application entitlements that Apple uses on the iPhone to control things like access to Push Notifcations and Payments. The open source libentitlement library, being developed at Docker, enables similarly high level controls to be used for managing containers. The talk will also cover the relationship with Open Policy Agent and other access control frameworks, and relation to Linux Security Modules and PodSecurityPolicy.
Justin Cormack is a security engineer at Docker. He has worked on runc, container isolation policies, virtualisation and container security, and knows his way around the Linux kernel and the container stack.
Nassim is a security engineer at Docker where he focuses on designing | and creating new security features for the container ecosystem and | making existing ones as usable as possible. Nassim previously spent a | couple of years working on hobby kernels and reverse-engineering | competitions... Read More →
