PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Digging Into Runtimes – runc

blog.quarkslab.com | research | #linux | #containers | #oci | #docker | #runc | #runtime
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A deep dive into runc, the standardized low-level runtime beneath Docker: container history from LXC to OCI, and how runc spawns and manages containers on Linux.
Published
Collected

Related coverage

research · blog.quarkslab.com
Digging into the OCI Image Specification
A deep dive into the OCI image specification behind container images: how it enables moving images between hosts and sharing filesystem layers efficiently across container processes.
research · blog.quarkslab.com
Let’s Go into the rabbit hole (part 1) — the challenges of dynamically hooking Golang programs
First part of a series on dynamically hooking Golang programs: why runtime detours are needed to instrument cloud-native tools like Kubernetes and gVisor, and why Go hooking is uniquely hard.
research · blog.quarkslab.com
Reversing Windows Container, episode I: Silo
Series opener on reversing Windows Containers: the user-land internals of Silo creation, the isolation mechanism underpinning the Server Silos that Docker uses on Windows.
research · blog.quarkslab.com
Why is Exposing the Docker Socket a Really Bad Idea?
Why exposing the Docker socket is dangerous: what read/write access to /var/run/docker.sock enables, with concrete examples escalating to root on the host.
vulnerability · aikido.dev
A Guide to Container Privilege Escalation Vulnerabilities
Container isolation breaks down when attackers escalate privileges, turning a low-privileged foothold into full host compromise. The guide covers CVE-2019-5736, CVE-2024-21626, and prevention.
blog · aikido.dev
Cloud Container Security: Protecting Kubernetes and Beyond
Unlike VMs, containers share the host kernel, so isolation alone isn't enough. The guide breaks down four layers—image, registry, runtime, and orchestrator—with practical steps to secure each.
Back