A decade ago runC escape CVE-2019-5736 proved a single process could seize an entire node. Five years later, CRI-O’s cr8escape showed the threat hadn’t gone away, it just moved. We’ll sprint through five pivotal CVEs that rewrote Kubernetes threat models and examine how these vulnerabilities were discovered, exploited, mitigated and we’ll uncover patterns and lessons that have shaped the security landscape.
Instead of a history lesson, we’ll decode each incident into a reusable threat-model pattern and will describe what capability was abused, which boundary failed, and which control closed the gap. Alongside the controls that were built into Kubernetes, we’ll spotlight the open-source tools that each crisis propelled into the cloud-native landscape and explain why operators still rely on them today.
Attendees will gain insight into how the security of containerized workloads has matured and explore the shifts within the ecosystem that have driven today’s increased resilience.