May 2-4, 2018 - Copenhagen, Denmark
Click Here For Information & Registration
View analytic
Thursday, May 3 • 16:35 - 17:10
Entitlements: Understandable Container Security Controls - Justin Cormack & Nassim Eddequiouaq, Docker (Intermediate Skill Level) (Slides Attached)

Sign up or log in to save this to your schedule and see who's attending!

Feedback form is now closed.
In this talk Justin Cormack introduces a new system of security entitlements for container workloads. These specify the types of access a pod should have in a human readable way. He will also demonstrate an example implementation running in Kubernetes.

The current pod security configuration is very low level, and does not really make any sense to users of the system. How can we make security configuration understandable? One route comes from the model of application entitlements that Apple uses on the iPhone to control things like access to Push Notifcations and Payments. The open source libentitlement library, being developed at Docker, enables similarly high level controls to be used for managing containers. The talk will also cover the relationship with Open Policy Agent and other access control frameworks, and relation to Linux Security Modules and PodSecurityPolicy.

avatar for Justin Cormack

Justin Cormack

Security Engineer, Docker
Justin Cormack is a security engineer at Docker. He has worked on runc, container isolation policies, virtualisation and container security, and knows his way around the Linux kernel and the container stack.
avatar for Nassim Eddequiouaq

Nassim Eddequiouaq

Security Engineer, Docker
Nassim is a security engineer at Docker where he focuses on designing | and creating new security features for the container ecosystem and | making existing ones as usable as possible. Nassim previously spent a | couple of years working on hobby kernels and reverse-engineering | competitions... Read More →

Thursday May 3, 2018 16:35 - 17:10