3 years ago

Category: Kubernetes, Docker

These days most of us are using the containerd runtime to manage our container’s lifecycle. That, of course, means we need to pay especially close attention to any possible containerd security issues. Alas, the UK security company NCC Group, has uncovered a potentially nasty one: CVE-2020-15257, containerd-shim API Exposed to Host Network Containers.

Sure, it’s best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces.

And you should update to these versions as soon as you can.