Hardware Podcasts

048 - A Bad Case of Kubernitis

Unnamed Reverse Engineering Podcast · 6 Jun 2021 · 1h 16m

What this episode covers

Mark Manning, a security architect at Snowflake and former NCC Group researcher, explains the underlying mechanics of containers, distinguishing them from virtualization by their shared kernel architecture. He details how technologies like Docker, Kubernetes, runc, and containerd manage process isolation via Linux namespaces, while highlighting significant security risks such as misconfigurations, the ease of bypassing controls, and the dangers of uncurated registries like Docker Hub. The discussion covers practical applications for reverse engineers, including using containers for reproducible environments and deploying lightweight clusters with K3s on Raspberry Pis, alongside warnings about cryptomining exploits and the complexity of modern container orchestration.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Heroku, Tesla, Snowflake, NCC Group
Products
HomeAssistant, Raspberry Pi
Tools
Docker, Kubernetes, runc, containerd, K3s, Whaler, DFImage, gvisor, podman, Hyper-V, SELinux, seccomp
Also
Docker Hub, Jessie Frazelle

Related episodes from other shows

Other shows on the same ground, closest first.

  • The Pragmatic Embedded Podcast · 49m

    Buzzword Bingo (or: which modern technologies make sense for embedded?)

    Hosts Jeff Gable and Luca Ingianni evaluate modern development buzzwords for embedded systems, discussing the applicability of web technologies like Kubernetes and Docker, the nuances of CI/CD pipelines, and the practical adoption of Rust and modern C++. They highlight specific tools such as Memfault, Mender, and Renode for observability and simulation, and analyze the role of AI in both device-side machine learning and developer productivity.

    Embedded firmwareMicrocontrollers & dev platforms
    8 chapters

  • Embedded.fm · 1h 10m

    515: Script Boomers

    Nick Kartsioukas, a Senior Security Engineer, discusses the evolving landscape of embedded system security, emphasizing the critical importance of Software Bill of Materials (SBOMs) and monitoring the Common Vulnerabilities and Exposures (CVE) database. He explains how to secure IoT devices through mutual TLS authentication and hardware roots of trust, while warning against the risks of using complex platforms like the Raspberry Pi in constrained environments. The conversation also covers threat modeling strategies, the crossover between safety and security, and practical advice for engineers to improve their security posture through Capture The Flag (CTF) challenges.

    Security & privacyConnected products & IoT
    8 chapters

  • The Pragmatic Embedded Podcast · 41m

    Replicable Build Environments for the Win

    Jeff Gable and Luca Injani discuss the evolution of build environments for embedded software, advocating for 'infrastructure as code' using Docker to ensure reproducibility and auditability. They trace the history from brittle manual scripts and 'magic' disk images to modern containerization, highlighting how Docker eliminates configuration drift and supports continuous integration. The hosts also address practical challenges, such as running graphical IDEs within containers, dealing with legacy tooling, and the preference for Linux over Windows for embedded development.

    Embedded firmwareEDA & CAD tools
    5 chapters

  • Oxide and Friends · 1h 23m

    Revisiting Unikernels

    Bryan Cantrill revisits his 2016 blog post 'Unikernels are unfit for production,' arguing that while the concept of reducing OS abstraction has merit, unikernels failed because they sacrificed debuggability and developer experience without delivering robust, real-world systems. Steve Klabnik and Dan Cross discuss the historical context of exokernels and the pragmatic middle ground, noting that technologies like Rust and Docker succeeded by balancing technical rigor with usability and tooling. The group contrasts the theoretical appeal of unikernels with the practical success of systems like Hubris and modern embedded tooling, concluding that debuggability and community support are essential for any new abstraction to succeed.

    Embedded firmwareDebugging & failure analysis
    13 chapters

  • Embedded.fm · 1h 14m

    373: Docker! Docker! Docker!

    Elecia White and Christopher White discuss the challenges of billing hourly work during long waits for code execution, and White's recent deep dive into Docker to manage complex development environments like TensorFlow. They also reflect on the Embedded.fm podcast's plateaued growth, strategies for promoting STEAM diversity, and the high production standards White's husband set for her upcoming conference talk on map files. Finally, White details her search for a new, quiet Windows laptop to replace her aging Dell.

    Embedded firmwarePricing, margins & unit economics
    6 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Unnamed Reverse Engineering Podcast. The episode itself belongs to its publisher.