/dev/loop3 ro squashfs ---------------------------------------------------------~inode 0x4e21c8
uts:ns 4026532198 ----------------------------------------------------------#cap_sys_admin -eff
seccomp filt 0x1f ---------------------------------------------------------#rtt 12.4ms mtu 1500
::fe80::4a2c/64 ::::::::::::::::::::::::::::::::::::::::::::::::::::::::[vmalloc 0xffffc90000]
Containers, kubernetes, AI, sandboxes, security, Linux isolation
and whatever else looks interesting enough to take apart.
kubernetes · 06 Apr 2026
· Containers
Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute I’ve been describing a common thread throughout these posts which is …
· Containers
Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute The other post, I’ve been mostly describing the operational burden of …
· Containers
Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute The idea behind seccomp profiles for a container is simple: your container …
· Containers
Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute It’s been a few weeks since I presented at BSidesSF. A talk called …
· Containers
Just leaving DEFCON and wanted to post my slide deck from the DEFCON Cloud Village. It’s a 20 minute talk so I focused on container registries with read access and write access. Here’s the deck: DEFCON Cloud …
· Containers
Seccompare.com quickly compares two container seccomp profiles and includes a handy syscall lookup table. Are you interested in some practical guidance for applying custom seccomp profiles for a container? You …
· Containers
seccomp-diff extracts the real seccomp filters straight from a running container Reverse engineering BPF taught me more about containers and syscalls than I expected seccomp good, seccomp at scale hard Ever wonder if …
· Containers
Take-aways Container registries are simple services ripe for subtle abuse They are trusted endpoints making them useful for exfil and post-exploitation It’s easy to make a malicious file appear like a legitimate …
· Containers
UPDATE 11/28/2020: Thanks to @jaybeale and @sethsec for pointing out I was calling it “OPA Gateway” instead of OPA Gatekeeper. UPDATE 3/20/2021: Tim Allclair and Jordan Liggitt have a proposal with a demo …
· Containers
I’m writing about the Kubernetes API’s use of the “LIST” verb it controls access to Secrets in a cluster. I’ve seen way too may environments, tools, templates, and examples that are hoping …
· Containers
TL;DR The Linux Kernel keyring is known to be a security issue for containers Download my tool for breaking out of a container to steal all the host keys here: keyctl-unmask We can use this in Kubernetes to steal all …
· Containers
Saturday, I gave my talk titled “Command and KubeCTL: Real-World Kubernetes Security for Pentesters” at Shmoocon 2020. I’m following up with this post that goes into more details than I could cover in …
· Containers
It’s been on my list for at least 6 months to start contributing to krew if possible. My first plugin is called net-forward and it’s very simple but confusing if you don’t see what I’m using it …
· Containers
Sometimes during a container or Kubernetes assessment, we get requested to review whether a runtime security tool that a client uses is sufficient for their threat model. This often means reviewing a custom seccomp-bpf …
· Containers
By default Docker allows all of their containers to run with the CAP_NET_RAW capability, I believe to easily support ICMP health checks when needed. Supporting ping makes sense but this post will go through why …
· Containers
After 8 years of Security B-Sides Rochester, it’s time for me to turn it over to new leadership that wants to keep the conference going. It’s exciting that people still want to. My role as of recent has been …
· Containers
This is a follow up from the Custom Seccomp profile post which went through some of the background information. Speed up custom seccomp profile generation with Syscall2seccomp You can always manually track down the …
· Containers
This post goes through building custom Docker seccomp profiles for your container. I’m not recommending you do this especially in enterprise environments, but I’m being charitable to the idea that system call …
· Containers
One of Docker’s many updates this year was adding seccomp support. In short, seccomp/secomp-bpf is a way of filtering the system calls that you want to allow an application to make. It’s used for sandboxing …
· Containers
Summary This blog post is going to show you how to go from exploiting a single container to gaining root on an entire cluster and all nodes. This is caused by a default flaw in the way Kubernetes manages containers. …
· Containers
If you’re like me and want to stand up a quick server that can response on all ports, here’s a quick way to do it. You’ll need a ton of memory to pull this off so setup your machine or VM accordingly. …
· Containers, anonymity
I’ve made a scalable way of building a fully private functioning tor network using Docker. Why give any back story, if it’s useful to you, then here you go: Source: https://github.com/antitree/private-tor-network Docker …