-
using OpenSSF best practices
Also create seccomp & apparmor profiles for running in containers securely
-
# OCI Security Context
## Summary
* The existing high-level container runtimes (e.g., `containerd`) offer their default Seccomp profiles that are allowlists of system calls to make containers se…
-
Hi,
I've noticed that on my systems (fedora, debian, alpine) it's possible to get network admin privileges in a user namespace within a container:
```
$ podman run --rm -ti docker.io/alpine
/ # …
-
#3883 and #3806 could be related
When running `firejail --profile=/etc/firejail/nuclear.profile nuclear` I get `The SUID sandbox helper binary was found, but is not configured correctly. Rather tha…
-
**Doc: Update developer doc example for libseccomp dependency on Ubuntu**
This is me being totally pedantic, but the [Build containerd from source](https://github.com/containerd/containerd/…
-
KubeArmor is a security engine and thus it is imperative that it follows all the security best practices. The aim is to ensure security of the KubeArmor itself. Much of the work towards following best…
-
### Description
After updating two of Debian 11.3 machines with the latest firejail release, Firefox no longer starts.
### Steps to Reproduce
`apt update` to get `firejail (0.9.64.4-2+deb11u1…
-
It seems to happen only with the snap package.
-
### Description
According to the [cri-api](https://github.com/kubernetes/cri-api/blob/12790a4ab088c6093e24421f073c269c6c2c101a/pkg/apis/runtime/v1/api.proto#L773) code, for a privileged container t…
ghost updated
1 month ago
-
I would like to suggest a manual or automatic update for profiles. It is noted that there are often problems with the profiles. Especially since not all users use the same versions of different progra…