Micromize: Enforcing Container Semantics with eBPF LSM
Containers should follow an opinionated runtime model. They are designed to be immutable, minimal and predictably constrained to specific behaviors. In practice, Linux gives us powerful primitives such as namespaces and cgroups, but those mechanisms do not directly enforce the higher-level semantics that make containers attractive in the first place.
A container may be packaged as a minimal immutable image, yet still drift at runtime, execute unexpected code, load unexpected objects, or reach kernel functionality unrelated to its purpose. The result is a gap between the way containers are intended to behave and what the kernel actually enforces.
This talk presents Micromize, an open-source project that uses eBPF LSM to narrow that gap. Micromize explores how an opinionated container runtime model can be translated into kernel-enforced constraints that preserve workload behavior after deployment.
We will cover the design, implementation tradeoffs, and open questions behind enforcing stricter container semantics at runtime: what can be enforced cleanly, what remains hard, where existing Linux mechanisms help, and where eBPF LSM gives us a new enforcement point.