PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Digging into the OCI Image Specification

blog.quarkslab.com | research | #linux | #containers | #oci | #docker | #standards | #image-spec
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A deep dive into the OCI image specification behind container images: how it enables moving images between hosts and sharing filesystem layers efficiently across container processes.
Published
Collected

Related coverage

research · blog.quarkslab.com
Digging Into Runtimes – runc
A deep dive into runc, the standardized low-level runtime beneath Docker: container history from LXC to OCI, and how runc spawns and manages containers on Linux.
research · blog.quarkslab.com
Reversing Windows Container, episode I: Silo
Series opener on reversing Windows Containers: the user-land internals of Silo creation, the isolation mechanism underpinning the Server Silos that Docker uses on Windows.
research · blog.quarkslab.com
Why is Exposing the Docker Socket a Really Bad Idea?
Why exposing the Docker socket is dangerous: what read/write access to /var/run/docker.sock enables, with concrete examples escalating to root on the host.
tool · github.com
Linux Container Escape PoCs for CVE-2026-52910 & CVE-2026-80521
Demonstrates that container isolation can be completely compromised via Linux kernel subsystem flaws, providing security researchers with reproducible testbeds to evaluate kernel-level container escape threats.
blog · netspi.com
Attacking Azure Container Registries with Compromised Credentials
Stolen Azure Container Registry admin credentials enable Docker login, image and tag enumeration via Registry REST APIs, and pulling containers to hunt secrets; MicroBurst's Get-AzACR automates it.
research · blog.quarkslab.com
Audit of Operator Fabric
Quarkslab's OSTIF-mandated audit of OperatorFabric, an LF Energy platform: five vulnerabilities include path traversal leading to RCE and Docker escape, a tar-slip attack and file upload flaws.
Back