A DevSecOps engineer is configuring a shared Linux compute host that executes untrusted CI/CD pipeline container images. To minimize the risk of a container process exploiting kernel vulnerabilities or escalating privileges on the underlying host operating system, which of the following controls should be implemented? (Select TWO.)
- Enable user namespaces (userns) to map container root UID 0 to an unprivileged user ID on the host OS.Cevap
- BDeploy a perimeter web application firewall (WAF) to inspect internal OS kernel system calls between containers.
- Apply custom SECCOMP profiles to restrict the specific Linux kernel system calls available to containerized processes.Cevap
- DRely on default container runtimes to provide hardware-enforced Type 1 hypervisor isolation across tenant workloads.
Cevap
The host environment is secured by configuring user namespaces to map container root privilege to an unprivileged host account and applying SECCOMP profiles to limit accessible kernel system calls.
Implementing user namespaces ensures that even if a container process is compromised as root inside its runtime container, it corresponds to an unprivileged account on the host system. Applying custom SECCOMP profiles further reduces kernel exploitation vectors by enforcing a strict filter on the Linux system calls allowed for the containerized application.
Adım Adım Çözüm
Anahtar Kavram
Container Host Isolation and Kernel Hardening Controls