Lightning Talk: lockc - Containing the Containers That Do Not Contain - Michal Rostecki
Channel: CNCF [Cloud Native Computing Foundation]
Date: 19/05/2022

Lightning Talk: lockc - Containing the Containers That Do Not Contain - Michal Rostecki, Deepfence Inc

lockc is open source software for providing MAC (Mandatory Access Control) type of security audit for container workloads, written in Rust in C (soon to be written fully in Rust). The main reason why lockc exists is that containers do not contain. Containers are not as secure and isolated as VMs. By default, they expose a lot of information about host OS and provide ways to "break out" from the container. lockc aims to provide more isolation to containers and make them more secure through policies enforces in the kernel. The main technology behind lockc is eBPF - to be more precise, its ability to attach to LSM hooks. This talk will also mention Aya and the ability to write eBPF programs in Rust.