AppSec California 2017

Container technologies like Docker are gaining mainstream interest from development organizations. Unlike virtual machines, containers running on the same host share the underlying OS kernel and filesystem. In this talk we describe an approach to harden and isolate containerized applications via file system monitoring. We show that it is possible to automatically build a whitelist of file system resources that are available to containers based on static analysis of the container contents and configuration. In addition containers can be monitored in runtime for storage writes of known exploits. We demonstrate how a mix of static and runtime file system monitoring proves to be an unintrusive and effective layer of security and isolation for containerized Cloud Native applications.