flock

#177 [Talk-50] Tighten container security by generating SECCOMP profiles using podman
Closed: Talk Not Scheduled by mattdm. Opened by weirdwiz.

Closed: Talk Not Scheduled
Reopen Issue

What is your proposal?

Podman is an open source CLI tool for working with containers, pods and container images. It uses a Linux kernel feature called SECCOMP to filter syscalls made by the processes inside the container. This allows Podman to reduce the attack surface of the kernel which is exposed to the container. Podman ships with a basic SECCOMP profile, which blocks 44 syscalls, but the default profile is very loose.
In this talk, I want to go through the technical details of how we implemented the feature which can generate a SECCOMP profile for a specific workload to tighten the security of the kernel by tracing/recording the syscalls of a given container and the set of syscalls is then used to create a new profile to reduce the attack surface. I would talk about the lessons learned while building the feature, all the problems encountered and their solutions.

Who in addition to the speaker needs to be in the room for this to succeed?

  • Dan Walsh FAS: dwalsh
  • Valentin Rothberg vrothberg
  • And an audience interested in learning about containers.

Is this a

  • 50 minutes: Talk

Anything else we need to know?

A video projector and possibly an internet connection

Who are you?

  • Name: Divyansh Kamboj
  • FAS ID: weirdwiz
  • IRC Nick, if not FAS ID: weirdwiz (freenode)

This seems interesting but I'm not sure of the audience. Is it really just "general container interest", or would this be useful for anyone interested in, say, updating their packages' systemd configuration?

Yes, anybody who is interested in containers, how they work, know about SECCOMP, etc would be benefited.

The talk selection committee feels like this would be better at a developer-focused conference. Fedora contributors and package maintainers are unlikely to get direct benefit here.

Metadata Update from @mattdm:
- Issue close_status updated to: Talk Not Scheduled
- Issue status updated to: Closed (was: Open)

Thanks for the consideration :D
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.