2 repository-uri
Awesome GitHub RepositoriesAnnotation-Based
Prevents users from setting container annotations that could alter runtime or systemd properties in unsafe ways.
Distinct from Privilege Escalation Prevention: Distinct from Privilege Escalation Prevention: focuses specifically on preventing escalation via container annotations, not general kernel-level controls.
Explore 2 awesome GitHub repositories matching security & cryptography · Annotation-Based. Refine with filters or upvote what's useful.
Awesome Annotation-Based GitHub Repositories
Găsește cele mai bune repo-uri cu AI.Vom căuta cele mai potrivite repository-uri folosind AI.
- cri-o/cri-o
cri-o/cri-o
5,629Vezi pe GitHubCRI-O is an open-source container runtime that implements the Kubernetes Container Runtime Interface (CRI) to manage container images, pods, and containers on cluster nodes using OCI-compatible runtimes. It serves as a node-level container manager that handles image pulling, container lifecycle, and resource monitoring for Kubernetes clusters, running containers according to the Open Container Initiative specifications. The runtime distinguishes itself through live configuration reloading that applies changes to runtime definitions, registry mirrors, and TLS certificates without restarting th
Prevents users from specifying annotations that alter runtime fields such as systemd properties, closing a privilege-escalation vector.
Go - opencontainers/runtime-spec
opencontainers/runtime-spec
3,641Vezi pe GitHubThe project provides an open container runtime specification and standardized schema for defining container configurations, namespaces, resource limits, security policies, and filesystem mounts across platforms. It outlines the formal configuration formats, lifecycle operations, and execution environments necessary for portable, isolated container workloads. The specification covers container lifecycle management protocols and structured rules governing container creation, execution startup, process signaling, state tracking, and resource teardown. It standardizes local bundle packaging and
Identifies specific configuration annotation keys and prefixes that may alter runtime behavior.
Gocontainersdockeroci
