Speaker: Nate Lager, @gangrif@undrground.org
Presenting: Kill the Drift, Shrink the Attack Surface: Hardening Linux Hosts with bootc
Abstract: Operating System (OS) config drift isn’t just an operational nuisance, it’s a security vulnerability. Every untracked change, emergency patch, or manual config fix can expand your attack surface and leaves room for persistence. What if your OS was managed like an application container, using the same CI/CD pipelines and supply chain tools that you use for containerized apps?
Well have you heard of bootc? By defining the host OS as a bootable container image, you can enforce state, automate vuln scanning and compliance at build time, and roll out updates with instant rollbacks. All on the Enterprise Linux base of Red Hat Enterprise Linux (RHEL)
In this hands-on 2-hour lab, I’ll show you how to build your first RHEL Image Mode image (based on bootc), secure it by applying security policy at build time, and then manage that bootable container image going forward. You’ll:
* Build a hardened, compliant, RHEL host image using standard podman container tooling
* Integrate compliance scanning and remediation at image build time
* Deploy and update systems using standard container registries
* Execute rollbacks during a simulated incident.
Prerequisites: Some basic familiarity with linux, and containers (docker or podman). A laptop with internet connection and a web browser.
Bio: Nate Lager, Principal Technical Marketing Manager, Red Hat
Nate has been using Linux since Red Hat 5.0. He has taken his passion for communities, technology, and open source from a hobby to a career over the past 20+ years. Evolving from hobbyist to system administrator, to Technical Account Manager, Nate is now a Pr. Technical Marketing Manager at Red Hat, and a content creator. From blogs, to live streams, to Podcasts, Nate has a passion for sharing his love of Linux and Technology.
Nate’s a nerd in his personal life too! TTRPGs like DnD, gaming, self-hosting, electronics projects, and even a DEFCON group (DC610) he helped found and still runs today.
When he’s not at the keyboard, he’s probably in the garage, or on the trails.
Socials
LinkedIN: https://www.linkedin.com/in/ironsysadmin
Mastodon @gangrif@undrground.org
Github: https://github.com/nlager
Audience: Anyone with basic linux skills, container knowledge is helpful but not requred. Sysadmins, Security Ops, anyone looking to learn about this new technology.
Duration (Minutes): 120
Recording/Streaming Status: N/A, Classes & Villages are not recorded
Click here to Sign-Up or use the embedded form below