/dev/loop3 ro squashfs ---------------------------------------------------------~inode 0x4e21c8
uts:ns 4026532198 ----------------------------------------------------------#cap_sys_admin -eff
seccomp filt 0x1f ---------------------------------------------------------#rtt 12.4ms mtu 1500
::fe80::4a2c/64 ::::::::::::::::::::::::::::::::::::::::::::::::::::::::[vmalloc 0xffffc90000]
Containers, kubernetes, AI, sandboxes, security, Linux isolation
and whatever else looks interesting enough to take apart.
kubernetes · 06 Apr 2026
· Containers
Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute I’ve been describing a common thread throughout these posts which is …
· Containers
Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute The other post, I’ve been mostly describing the operational burden of …
· Containers
Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute The idea behind seccomp profiles for a container is simple: your container …
· Containers
Sandboxes, Seccomp, and Syscalls Building Insecure and Incomplete Profiles Bypasses and Breakouts Measuring Scoring and Scaling with Seccompute It’s been a few weeks since I presented at BSidesSF. A talk called …
· Containers
UPDATE 11/28/2020: Thanks to @jaybeale and @sethsec for pointing out I was calling it “OPA Gateway” instead of OPA Gatekeeper. UPDATE 3/20/2021: Tim Allclair and Jordan Liggitt have a proposal with a demo …
· Containers
I’m writing about the Kubernetes API’s use of the “LIST” verb it controls access to Secrets in a cluster. I’ve seen way too may environments, tools, templates, and examples that are hoping …
· Containers
Saturday, I gave my talk titled “Command and KubeCTL: Real-World Kubernetes Security for Pentesters” at Shmoocon 2020. I’m following up with this post that goes into more details than I could cover in …
· Containers
It’s been on my list for at least 6 months to start contributing to krew if possible. My first plugin is called net-forward and it’s very simple but confusing if you don’t see what I’m using it …
· Containers
Summary This blog post is going to show you how to go from exploiting a single container to gaining root on an entire cluster and all nodes. This is caused by a default flaw in the way Kubernetes manages containers. …