Restricted Address Spaces for Container Security

Explore container security through restricted address spaces in this 30-minute conference talk by IBM experts Mike Rapoport and James Bottomley. Delve into topics such as container images, hardware resolution, vulnerability, and parent namespaces. Examine network namespaces, unmapped management, and related use cases. Gain insights into kernel page tables, direct mapping, and benchmarks. Investigate cache considerations, GFP and Lab exclusives, metadata, and the networking stack. Conclude with testing methodologies and key takeaways for enhancing container security through address space restrictions.