PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reversing Windows Container, episode I: Silo

blog.quarkslab.com | research | #windows | #reverse-engineering | #containers | #docker | #isolation | #silo
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Series opener on reversing Windows Containers: the user-land internals of Silo creation, the isolation mechanism underpinning the Server Silos that Docker uses on Windows.
Published
Collected

Related coverage

research · blog.quarkslab.com
Digging into the OCI Image Specification
A deep dive into the OCI image specification behind container images: how it enables moving images between hosts and sharing filesystem layers efficiently across container processes.
research · blog.quarkslab.com
Digging Into Runtimes – runc
A deep dive into runc, the standardized low-level runtime beneath Docker: container history from LXC to OCI, and how runc spawns and manages containers on Linux.
research · blog.quarkslab.com
Why is Exposing the Docker Socket a Really Bad Idea?
Why exposing the Docker socket is dangerous: what read/write access to /var/run/docker.sock enables, with concrete examples escalating to root on the host.
research · blog.quarkslab.com
Digging into Linux namespaces - part 2
Part two of the Linux namespaces series: USER, MNT, UTS, IPC and CGROUP namespaces examined, then combined to build a fully isolated environment for a process.
research · blog.quarkslab.com
Digging into Linux namespaces - part 1
Part one of the Linux namespaces series: what namespaces are, how they give processes independent system views, and the clone/unshare syscalls used to create them.
blog · aikido.dev
When read-only mounts in Docker Sandboxes become writable
This coverage gives security teams current context for monitoring, validation, and remediation.
Back