Results for “container-runtime”

Analyze running containers in a CTF sandbox by comparing declared configuration with live processes, mounts, and routes. Trace how secrets and helper containers affect behavior, then document the earliest mismatch and a minimal evidence chain.

• Comparing container manifests with live runtime behavior
• Identifying which process consumes a mounted secret
• Tracing changes made by sidecars or init containers

Create and tune Falco rules to detect possible container escapes, where a container gains access to its host. Define detection conditions, alert priorities, and output fields, then refine exceptions to reduce false positives.

• Writing rules for suspicious host filesystem access
• Investigating noisy container escape alerts
• Reusing detection conditions through macros and lists

Deploy and operate Falco to monitor running containers in Kubernetes or Docker. Choose a driver, validate detection rules, confirm alerts for suspicious activity, and forward those alerts to a central security monitoring system.

• Installing Falco on a Kubernetes cluster
• Choosing a driver for the Linux environment
• Checking alerts for suspicious container activity

Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.

• Tracing API activity during a suspected cluster compromise
• Reviewing access to Kubernetes secrets
• Investigating permission changes and privileged pods

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for live container runtime analysis, mounted secrets, sidecars, namespaces, init containers, entrypoint drift, and route-to-container resolution. Use when the user asks why a live container differs from manifests, where a mounted secret is consumed, how a sidecar or init container changes runtime state, or which route resolves to which live container. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

The English summary is being prepared. Showing the original description.

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

The English summary is being prepared. Showing the original description.

bu skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring. It addresses cloud-specific security features including IRSA for EKS, Workload Identity for GKE, and Managed Identities for AKS.

The English summary is being prepared. Showing the original description.