A Containerised App on Kubernetes

Its Layers

Kubernetes runs the app in a container on a Linux node. A container escape reaches that node.

The stack runs from the top layer down, as on the topic page. Each layer shows its technology, and the badge beside it says who runs and patches it.

Who Runs What

On a managed service such as Amazon EKS or Azure Kubernetes Service, the cloud provider runs the Kubernetes control plane. You run the app and its container images, and the Linux nodes unless the service manages those too. Run Kubernetes yourself and every layer is yours.

You

Your team runs it and installs its updates.

Your Host

A hosting or cloud provider runs it and patches it for you.

Where Its Code Comes From

Outside code arrives as container images and Helm charts, the packaged deployments Helm installs on Kubernetes, as well as npm packages. The pipeline that builds them can change any of it, and the nodes' own software comes from the Linux distribution's packages.

• Container Images
• Helm Charts
• npm
• CI and Build Systems
• OS Packages

Well-Known Flaws in Its Layers

These are well-known flaws in the technologies this stack is built from. Each CVE id links to its advisory, and the technology's own page says how far that flaw reached.

• CVE-2018-1002105 (opens in a new tab)2018

  API Server Privilege Escalation, in Kubernetes

  Crafted requests could reach backend services through the API server, using its credentials.

• CVE-2016-5195 (opens in a new tab)2016

  Dirty COW, in Linux

  A race condition in the Linux kernel let a local user gain root.

Sources

• AWS: what is Amazon EKS? (opens in a new tab)
• Microsoft Learn: what is Azure Kubernetes Service? (opens in a new tab)