“container-runtime”的搜索结果

Analyze running containers in a CTF sandbox by comparing declared configuration with live processes, mounts, and routes. Trace how secrets and helper containers affect behavior, then document the earliest mismatch and a minimal evidence chain.

中文简介正在准备中。当前显示英语简介。

• Comparing container manifests with live runtime behavior
• Identifying which process consumes a mounted secret
• Tracing changes made by sidecars or init containers

Deploy and operate Falco to monitor running containers in Kubernetes or Docker. Choose a driver, validate detection rules, confirm alerts for suspicious activity, and forward those alerts to a central security monitoring system.

中文简介正在准备中。当前显示英语简介。

• Installing Falco on a Kubernetes cluster
• Choosing a driver for the Linux environment
• Checking alerts for suspicious container activity

Create and tune Falco rules to detect possible container escapes, where a container gains access to its host. Define detection conditions, alert priorities, and output fields, then refine exceptions to reduce false positives.

中文简介正在准备中。当前显示英语简介。

• Writing rules for suspicious host filesystem access
• Investigating noisy container escape alerts
• Reusing detection conditions through macros and lists

Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.

中文简介正在准备中。当前显示英语简介。

• Tracing API activity during a suspected cluster compromise
• Reviewing access to Kubernetes secrets
• Investigating permission changes and privileged pods

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for live container runtime analysis, mounted secrets, sidecars, namespaces, init containers, entrypoint drift, and route-to-container resolution. Use when the user asks why a live container differs from manifests, where a mounted secret is consumed, how a sidecar or init container changes runtime state, or which route resolves to which live container. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

中文简介正在准备中。当前显示原文说明。

Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.

中文简介正在准备中。当前显示原文说明。

bu skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring. It addresses cloud-specific security features including IRSA for EKS, Workload Identity for GKE, and Managed Identities for AKS.

中文简介正在准备中。当前显示原文说明。