Snooping on libpam (openssh auth, passwd) with Golang and eBPF

Snooping on libpam (openssh auth, passwd) with Golang and eBPF
In the vast and complex landscape of software security, safeguarding sensitive information remains a paramount concern for developers and security professionals alike. Among the myriad of challenges, securely managing and protecting credentials during authentication processes stands out as a critical vulnerability point. Traditional security measures often fall short in providing real-time insights into how credentials are handled and potentially exposed within applications, especially those relying on widely used authentication frameworks like PAM (Pluggable Authentication Modules).
Read more →

Docker Overlayfs: How filesystems work in Docker

Docker Overlayfs: How filesystems work in Docker
This is a brief follow up to my article on Docker networking: Network Namespaces, Docker Bridge and DNS Docker uses OverlayFS to manage the file system of its containers. When a container is run, Docker creates a new layer for the container’s file system on top of the base image. This allows the container to have its own file system that is isolated from the host system and other containers.
Read more →

Docker networking: Network Namespaces, Docker Bridge and DNS

Docker networking: Network Namespaces, Docker Bridge and DNS
Ever wondered how docker compose lets you communicate between services? This article takes a high level look at network namespaces, Dockers internal DNS and Docker bridge. Network namespaces are a powerful feature in Linux that allows for the isolation of network stacks, creating multiple virtual networks on a single host. This concept is particularly useful for scenarios such as containerization, where each container needs its own independent network stack. In this article we’ll take a look at how docker / docker compose utilize this technology to grant containers network isolation and also take a look at how docker handles cross-container networking.
Read more →

Perf engineering with Python 3.12

Perf engineering with Python 3.12
Since Python 3.12, the interpreter can run in a special mode that allows Python functions to appear in the output of the perf profiler. When this mode is enabled, the interpreter will interpose a small piece of code compiled on the fly before the execution of every Python function and it will teach perf the relationship between this piece of code and the associated Python function using perf map files. We’ll create a dummy application and use the new tools to solve a perf issue.
Read more →