BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.all-systems-go.io//all-systems-go-2026//ADB7KB
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-all-systems-go-2026-WUH9WS@cfp.all-systems-go.io
DTSTART;TZID=CET:20260930T104500
DTEND;TZID=CET:20260930T111000
DESCRIPTION:Containers should follow an opinionated runtime model. They are
  designed to be immutable\, minimal and predictably constrained to specifi
 c behaviors. In practice\, Linux gives us powerful primitives such as name
 spaces and cgroups\, but those mechanisms do not directly enforce the high
 er-level semantics that make containers attractive in the first place.\n\n
 A container may be packaged as a minimal immutable image\, yet still drift
  at runtime\, execute unexpected code\, load unexpected objects\, or reach
  kernel functionality unrelated to its purpose. The result is a gap betwee
 n the way containers are intended to behave and what the kernel actually e
 nforces.\n\nThis talk presents Micromize\, an open-source project that use
 s eBPF LSM to narrow that gap. Micromize explores how an opinionated conta
 iner runtime model can be translated into kernel-enforced constraints that
  preserve workload behavior after deployment.\n\nWe will cover the design\
 , implementation tradeoffs\, and open questions behind enforcing stricter 
 container semantics at runtime: what can be enforced cleanly\, what remain
 s hard\, where existing Linux mechanisms help\, and where eBPF LSM gives u
 s a new enforcement point.
DTSTAMP:20260815T225448Z
LOCATION:Galerie
SUMMARY:Micromize: Enforcing Container Semantics with eBPF LSM - Dor Serero
URL:https://cfp.all-systems-go.io/all-systems-go-2026/talk/WUH9WS/
END:VEVENT
END:VCALENDAR