Rory McCune
raesene.github.io · Personal blog · on HN since 2014
Rory McCune, a security specialist, writes about container and Kubernetes security, Docker risks and scanner bypasses.
What HN saysHN commenters cite him on how vulnerability scanners can be bypassed, why mounting docker.sock read-only doesn't help, and Kubernetes etcd security.
15HN people shared it
5linked it in comments
22stories submitted
40story points
4 months agolast shared
2014people per year2026
Most-shared posts
- 1Let's talk about Kubernetes on the Internet2 people · 5 points · first shared 2022 · discussion on HN
- 2Bitnami Deprecation2 people · 4 points · first shared 2025 · discussion on HN
- 3Fun with container images – Bypassing vulnerability scanners2 people · 3 points · first shared 2023 · discussion on HN
- 4Restricting Docker Access with a Reverse Proxy2 people · 2 points · first shared 2021 · discussion on HN
- 5The Dangers of Docker.sock2 people · 1 points · first shared 2016 · discussion on HN
- 6Finding Security2 people · 1 points · first shared 2014 · discussion on HN
- 7Kubernetes From Container To Cluster2 people · first shared 2016
- 8Fun with Capabilities1 people · 3 points · first shared 2022 · discussion on HN
- 9Fun with GitRepo Volumes1 people · 2 points · first shared 2024 · discussion on HN
- 10Taking a Look at Kubernetes Profiling1 people · 2 points · first shared 2024 · discussion on HN
- 11Getting into a Bind with Kubernetes1 people · 2 points · first shared 2021 · discussion on HN
- 12A Final Kubernetes Census1 people · 2 points · first shared 2024 · discussion on HN
- 13PCI Guidance for Containers and Container Orchestration Tools1 people · 2 points · first shared 2022 · discussion on HN
- 14Escalating Away – Kubernetes Roles Based Access System1 people · 2 points · first shared 2021 · discussion on HN
- 15Changing Times – End of SMS Authentication?1 people · 2 points · first shared 2014 · discussion on HN
What HN people wrote when they linked it
raesene9 · 2023-12-30
It's worth noting that whilst vulnerability scanners are very useful, they pretty easy to bypass, if someone creates an image and doesn't want them to flag things up.
One very basic example is https://raesene.github.io/blog/2023/04/22/Fun-with-container-images-By…
fpgaminer · 2018-06-15
According to this: https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Docker.sock/
mounting the socket readonly doesn't help.
raesene6 · 2017-05-08
no worries, I've got some more info. on that on my blog https://raesene.github.io/blog/2017/05/01/Kubernetes-Security-etcd/ which may be of use.
clebio · 2017-02-19
Link in parenthesis got broken: https://raesene.github.io/blog/2016/10/08/Kubernetes-From-Container-To…
raesene4 · 2015-10-02
so with two patreon style sites both of which say "we take security seriously" , until they have a breach, how would you judge which one would take better care of your data?
The information (AFAIK) about their security mechanisms only got released as a result of the breach, so even assuming you knew what the terms were and how to judge good security from bad, you wouldn't have the information until the site got compromised.
This is a very common problem, some more examples here http://raesene.github.io/blog/2014/06/08/finding-security/