New containerd Security Hole Needs to Be Patched ASAP

4 years ago thenewstack.io

Summary: This is a summary of an article originally published by The New Stack. Read the full original article here →

These days most of us are using the containerd runtime to manage our container’s lifecycle. That, of course, means we need to pay especially close attention to any possible containerd security issues. Alas, the UK security company NCC Group, has uncovered a potentially nasty one: CVE-2020-15257, containerd-shim API Exposed to Host Network Containers.

Sure, it’s best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces.

And you should update to these versions as soon as you can.

DevOps Articles