Securing Ephemeral Kubernetes Pods

Excited to share a proof-of-concept I’ve been working on. Kubefence — a Kubernetes Node Resource Interface (NRI) plugin that transparently sandboxes container processes using nono - https://nono.sh/. Nono leverages the Landlock Linux Security Module (LSM) to make process-level sandboxing easy to use. You should try it out if you haven't yet. 💡 Motivation for Kubefence I wanted to explore a practical way to bring LSM-based sandboxing into Kubernetes workloads for different container runtimes. Kubefence is an attempt in that direction. ⚙️ How it works - A DaemonSet registers as an NRI plugin with containerd / CRI-O - Pods opting in via a nono-sandbox RuntimeClass are intercepted at creation time - The plugin rewrites the container entrypoint to wrap execution with nono: "/nono/nono wrap --profile default -- <original command>" The nono binary is bind-mounted from the host 🔧 Compatibility Works with: runc-based containers and Kata Containers 🧪 Try it out 🔗 https://lnkd.in/gCYuUuwe Would love feedback especially on using the NRI plugin approach for securing agent workloads in Kubernetes.

Security starts with the right permissions. Running pods as root will cause you so much headache. Here is an excellent lab to help you see the impact. You can run it locally with Minikube! Here are some things I have been learning in my studying for the CKS that can help. • PodSecurity Standards and Admission Controllers: Leverage Kubernetes native features like PodSecurity admission to enforce non-root execution policies, ensuring compliance is baked into your cluster setup. • CICD Pipeline Security Scans: Integrate security scanners like Trivy or Kubeaudit into your CI/CD pipelines to identify and block image builds that require root privileges, ensuring only compliant images are created. • Container Security Contexts: Use Kubernetes securityContext to explicitly define non-root user settings (runAsUser, runAsGroup, allowPrivilegeEscalation) in your manifests, and enforce their use through tools like OPA/Gatekeeper policies in your GitOps workflow.