Choose Your Shield - Evaluating Linux Security Modules for Cloud Native Ecosystems

Explore this 34-minute conference talk that evaluates Linux Security Modules (LSMs) for cloud native environments through the perspective of KubeArmor, a CNCF sandbox runtime security engine. Learn how LSMs provide kernel-level security mechanisms to address dynamic cloud native security challenges and discover practical insights from KubeArmor maintainers who implement these technologies to protect cloud workloads at runtime. Examine three major LSMs - SELinux, AppArmor, and BPF-LSM - across critical evaluation dimensions including performance impact and overhead analysis, security capabilities against common attack vectors demonstrated through live examples, and operational complexity covering implementation learning curves and maintenance requirements. Gain understanding of how different LSMs vary in effectiveness based on specific use cases, deployment contexts, and operational requirements in cloud native ecosystems. Access practical knowledge from experienced practitioners who work directly with these security technologies to build robust runtime protection systems for modern cloud workloads.