Container Security

KubeKeeper: Protecting Kubernetes Secrets Against Excessive Permissions

Kubernetes has become the dominant platform for managing containerized applications, but its native Secrets management mechanisms introduce security vulnerabilities, especially in environments where third-party applications may have excessive …

Confine: Fine-grained System Call Filtering for Container Attack Surface Reduction

Reducing the attack surface of the OS kernel is a promising defense-in-depth approach for mitigating the fragile isolation guarantees of container environments. In contrast to hypervisor-based systems, malicious containers can exploit vulnerabilities …