Forging Valeris: Building a Rust CLI to Secure Docker & Kubernetes

Build log of Valeris, a Rust CLI that scans Docker (and soon Kubernetes) for misconfigurations: design, code, plugin architecture and the checks themselves.

Chapters
2 chapters
Total reading time
21 min of reading
Written
2025
Start with chapter 1

Chapters, in order

  1. 1 Docker Security: Dissecting Namespaces, cgroups, and the Art of Misconfiguration Docker uses namespaces, cgroups & OverlayFS for isolation, but misconfigs (root, --privileged, sensitive mounts) weaken security. Valeris, a Rust CLI, audits running containers, flags risks, and provides a checklist to harden deployments. 9 min
  2. 2 When Containers Lie: Escaping Root and Breaking Docker Isolation We explore how root containers and host mounts enable privilege escalation, from SUID binaries in shared volumes to abusing /proc/<PID>/root. Then we show how Valeris detects these risky setups with YAML-based rules before they lead to full host compromise. 12 min
All series