Viewing profile — eyberg

Containers and security are oxymorons. The flood of page cache cves (which can always be escalated/weaponized to an escape) from the other month is making deploying containers to p…

So first off - NVD has been sliding for a long time now. This has nothing to do with mythos. The amount of money that goes into this program for the output is straight up criminal.…

No they have not been. There were at least 16 container escapes last year - at least 8 of them were at the runtime layer. I personally spent way too much time looking at this in th…

Except this is very clearly running linux.

The majority of nanos users don't do either of these methods. They simply create the image (in the case of aws that's an ami) and boot it. This is part of what makes them vastly mo…

https://github.com/containers/bubblewrap/issues/142

A lot of these "ai sandbox" conversations target code that is already running in a public cloud. Running firecracker doesn't give you magical isolation properties vs running an app…

No they are not. The "industry" totally disagrees with this statement as well.

> Escaping a properly set up container is a kernel 0day. Not it is not. In fact many of the container escapes we see are because of bugs in the container runtimes themselves which …

Duplicating a networking and storage layer on top of existing storage/networking layers that containers, and the orchestrators such as k8s provide, absolutely degrade performance -…

A shell by design is explicitly made to run other programs. You type in 'ls', 'cd', 'cat', etc. but those are all different programs. A "webshell" can work to a degree as you could…

We don't enable that exec-protect feature on by default explicitly for this reason. You are right - jit needs it.

Let's see last month (November 2025) we had CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 alone. Container breakouts happen almost monthly .

I can't speak for all the various projects but imo these aren't made for bare metal - if you want true bare metal (metal you can physically touch) use linux. One of the things that…

To be clear there are still numerous attacks one might lob at you. For instance you if you are running a node app and the attacker uploads a new js file that they can have the inte…

Containers got popular at at time when there were an increasingly number of people that were finding it hard to install software on their system locally - especially if you were, f…

a) containers don't contain b) if you want to limit your hosting environment to only the language/program you expect to run you should provision with unikernels which enforce it

It's confusing but CVE-2025-55184 was released today (not the ones last week). CVE-2025-67779 is an update to that one.