/dev/loop3 ro squashfs ---------------------------------------------------------~inode 0x4e21c8
uts:ns 4026532198 ----------------------------------------------------------#cap_sys_admin -eff
seccomp filt 0x1f ---------------------------------------------------------#rtt 12.4ms mtu 1500
::fe80::4a2c/64 ::::::::::::::::::::::::::::::::::::::::::::::::::::::::[vmalloc 0xffffc90000]
Containers, kubernetes, AI, sandboxes, security, Linux isolation
and whatever else looks interesting enough to take apart.
research · 10 Aug 2025
· Containers
Just leaving DEFCON and wanted to post my slide deck from the DEFCON Cloud Village. It’s a 20 minute talk so I focused on container registries with read access and write access. Here’s the deck: DEFCON Cloud …
· Containers
Seccompare.com quickly compares two container seccomp profiles and includes a handy syscall lookup table. Are you interested in some practical guidance for applying custom seccomp profiles for a container? You …
· Containers
seccomp-diff extracts the real seccomp filters straight from a running container Reverse engineering BPF taught me more about containers and syscalls than I expected seccomp good, seccomp at scale hard Ever wonder if …
· Containers
I’m writing about the Kubernetes API’s use of the “LIST” verb it controls access to Secrets in a cluster. I’ve seen way too may environments, tools, templates, and examples that are hoping …
· Containers
TL;DR The Linux Kernel keyring is known to be a security issue for containers Download my tool for breaking out of a container to steal all the host keys here: keyctl-unmask We can use this in Kubernetes to steal all …