# 048 - A Bad Case of Kubernitis

- Show: [Unnamed Reverse Engineering Podcast](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast)
- Published: 2021-06-06
- Length: 1h 16m
- Page: https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis
- Listen: https://unnamedre.com/episode/48

## Summary

Mark Manning, a security architect at Snowflake and former NCC Group researcher, explains the underlying mechanics of containers, distinguishing them from virtualization by their shared kernel architecture. He details how technologies like Docker, Kubernetes, runc, and containerd manage process isolation via Linux namespaces, while highlighting significant security risks such as misconfigurations, the ease of bypassing controls, and the dangers of uncurated registries like Docker Hub. The discussion covers practical applications for reverse engineers, including using containers for reproducible environments and deploying lightweight clusters with K3s on Raspberry Pis, alongside warnings about cryptomining exploits and the complexity of modern container orchestration.

## Chapters

- [0:28](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=28) Introduction: Mark Manning and the nature of containers
- [2:49](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=169) Containers vs. Virtualization: Linux namespaces and kernel sharing
- [5:05](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=305) Kubernetes as an orchestration platform for scaling containers
- [8:15](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=495) Security isolation failures and the risk of misconfigurations
- [12:42](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=762) Container internals: runc, containerd, and the boot process
- [17:37](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=1057) Unconventional container use cases: Cars, firewalls, and HSMs
- [22:51](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=1371) Dockerfiles, images, and the layer-based storage model
- [35:11](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=2111) Reverse engineering Docker images with Whaler and DFImage
- [43:14](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=2594) Hardware integration: K3s, Raspberry Pis, and clusters
- [54:15](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis#t=3255) Risks of Docker Hub, cryptomining, and the 'hate learning' philosophy

## Topics

- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Embedded firmware](https://hardwarepodcasts.com/topic/embedded-firmware)
- [PCB design & layout](https://hardwarepodcasts.com/topic/pcb-design)
- [Debugging & failure analysis](https://hardwarepodcasts.com/topic/debugging-and-failure-analysis)
- [Microcontrollers & dev platforms](https://hardwarepodcasts.com/topic/microcontrollers-and-platforms)

## Most relevant to

early-stage companies

## Mentioned

- Docker (tool)
- Kubernetes (tool)
- runc (tool)
- containerd (tool)
- K3s (tool)
- Docker Hub (other)
- Whaler (tool)
- DFImage (tool)
- HomeAssistant (product)
- Raspberry Pi (product)
- Heroku (company)
- Tesla (company)
- Snowflake (company)
- NCC Group (company)
- gvisor (tool)
- podman (tool)
- Hyper-V (tool)
- SELinux (tool)
- seccomp (tool)
- Jessie Frazelle (other)

## Related episodes from other shows

- [Buzzword Bingo (or: which modern technologies make sense for embedded?)](https://hardwarepodcasts.com/podcast/the-pragmatic-embedded-podcast/2024-11-13-buzzword-bingo-or-which-modern-technologies-make-sense-for-embedded) (The Pragmatic Embedded Podcast)
- [515: Script Boomers](https://hardwarepodcasts.com/podcast/embedded-fm/2025-11-27-515-script-boomers) (Embedded.fm)
- [Replicable Build Environments for the Win](https://hardwarepodcasts.com/podcast/the-pragmatic-embedded-podcast/2021-03-16-replicable-build-environments-for-the-win) (The Pragmatic Embedded Podcast)
- [Revisiting Unikernels](https://hardwarepodcasts.com/podcast/oxide-and-friends/2023-01-24-revisiting-unikernels) (Oxide and Friends)
- [373: Docker! Docker! Docker!](https://hardwarepodcasts.com/podcast/embedded-fm/2021-05-13-373-docker-docker-docker) (Embedded.fm)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2021-06-06-048-a-bad-case-of-kubernitis. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Unnamed Reverse Engineering Podcast.