This article is about containers, the different types (depending on what privileges we let them have), and how they build their isolation: mainly kernel namespaces and capabilities, overlay filesystems, seccomp, and SELinux. My motivation to start this article was for me to understand a bit better how the combination of container isolation mechanisms and privileges affects (increasing or decreasing) the risk of kernel flaws.Continue reading “Containers: Rootful, Rootless, Privileged and Super Privileged”
Tag: User namespaces
- The value of a pentest
- Off the top of my head: Is availability really a cybersecurity pillar?
- Off the top of my head: About having everything green in Qualys
- Information security requirements on the US “Executive Order on Improving the Nation’s Cybersecurity”
- How to find OpenSSL in our infrastructure