Don’t Trust Your Neighbors: Securing Pods via Scheduling - Michael Le, IBM & Sascha Grunert, Red Hat
Channel: The Linux Foundation
Date: 2023-06-01

Don’t Trust Your Neighbors: Securing Pods via Scheduling - Michael Le, IBM & Sascha Grunert, Red Hat

No matter how much effort you put into securing your container, the mere presence of a vulnerable neighboring container may jeopardize your container’s security. That’s because containers share a highly-privileged host kernel and it may harbor vulnerabilities that can be exploited via system calls to escalate privileges and break out of containment (e.g., Dirty COW/Pipe vulnerabilities). So a container's security must also depend on the security of its neighboring containers and their system call usage, which you may not have any control over. This talk will present a way to curtail the impact of having insecure neighbors by using a new security-aware pod scheduling scheme (SySched) for Kubernetes that co-locate pods based on their system call exposure risk. Experimental results will show that even if such kernel attacks were successful, they would impact fewer pods (up to 48% less) and fewer nodes (up to 46% less) than when using the default Kubernetes scheduler. The talk will detail how the scheduling scheme works and how to deploy the scheduler plugin in Kubernetes. In the process, you will also learn how to use the community-developed Security Profile Operator to generate, store, and manage access to a pod’s system call profile which is key to the operation of SySched.