This is a list of more in-depth articles than can be worth reading to get a better understanding of some of the underlying technologies used by Containers and how things like Kubernetes work.
- Brief Container History
- Series of posts from 2013 on the history of container engines leading up to Docker
- Post on Linux Bridging
- Posts on Docker MACVLAN
- Post detailing how Docker union Filesystems and storage drivers work
- Post on union file systems
- Post with some opinions on the available Docker storage graphdrivers
-
Understanding and Hardening Linux Containers - Whitepaper that goes into detail about container fundamental security.
-
Series of posts from Ian Lewis on Container runtimes
-
Good Series of Articles on Namespaces
-
Post specifically focusing on the PID namespace and it's relation to containers
-
Post from Jessie Frazelle about non-namespaces resources in Linux
-
Good series of posts on capabilities from siphos
-
This post goes into the slightly obscure topic of "ambient capabilities"
-
Post from spender of grsecurity. Talks about privesc possibilities from certain capabilities
-
Abusing Privileged and Unprivileged Linux Containers whitepaper on container breakout techniques, including focus on NET_RAW.
-
Good post on Capabilites, seccomp and the practical use of file capabilities
- Post about how registries can be used/abused
- ContainerDrip write-up with good details on how registries work
- Post that goes into a lot of detail of how Kubernetes works to create a deployment
- Post on What a Kubernetes Pod is
- Post on the pause container
-
Website that goes into detail on the Kubernetes networking model
-
Good set of posts on Container networking setup
- Playlist of Kubernetes pentesting/security videos
- Post on creating reverse shells from Docker and Kubernetes
- Post on getting reverse shells on every node in a cluster