descriptors # kubectl run --rm -it bb --image=busybox sh / # f(){ f|f& };f # WARNING: Don't try this! Things We Have Done 1. Hardware Isolation 2. Security Tools - SELinux, Seccomp, AppArmor TrustedSandbox=false Firecracker- containerd runnc+Nabla OCI Solution OCI Compa tible Dedicated Docker Image Impleme ntation Language Open source Hot plug Direct access to HW Required Hyperviso rs Backed "true" spec: containers: - name: nginx image: nginx EOT Rust- VMM Demo Future Works • Extend Rust-VMM to support networking and storage • Security policy integration • Develop a new fully Rust-based

#IstioCon Istio Architecture Connect, secure, control, and observe services. #IstioCon Security Architecture #IstioCon Bookinfo architecture without service mesh ● Reviews-v1 ○ doesn’t call accept only plain text ● UNSET: inherit from parent, default to PERMISSIVE if no set apiVersion: "security.istio.io/v1beta1“ kind: "PeerAuthentication“ metadata: name: "demo-peer-policy“ namespace: "default“ gateway Access productpage #IstioCon Authorize ingress traffic with JWT token apiVersion: "security.istio.io/v1beta1“ kind: "RequestAuthentication“ metadata: name: "jwt-example“ namespace: istio-system

Microkernel Overview I. Background  https://en.wikipedia.org/wiki/Microkernel Security I. Background  Difference Between Microkernel and Monolithic Kernel: Source: https://www with usermode VMMs Source: https://sel4.systems/About/seL4-whitepaper.pdf 1.2.1.3 Provable Security I. Background  .  https://docs.sel4.systems/projects/l4v/ https://github

Rust 重塑移动应用开发 PhoTto / image / chart Keystone Keystone is aiming to develop the most secure and easyuse hardware wallet for the Web3 world 利用 Rust 重塑移动应用开发 Photo / image / chart 采用 Rust 重构业务逻 辑的背景和动机 Javascript is very poor. Therefore, we plan to use Rust to provide high performance 2); Photo / image / chart Rust FFI Rust FFI (Foreign Function Interface) refers to the ability of Rust programming functions and use data structures defined in other languages, and vice versa. 利用 Rust 重塑移动应用开发 Photo / image / chart Rust FFI on Android - NDK The Android NDK is a toolset that lets you implement parts of

Users and Partners (selected) x x Main Features 6 Web Portal • Based on open source Clarity • Image operation full capabilities • Batch operations Restful API • Complete API for integration • Swagger user experiences with image management Multi Deployments • Docker Compose • BOSH/Pivotal Tile • Helm Chart Label • Label in project and system scopes • Mark labels to image and chart Harbor Architecture Architecture API Routing API Routing Core Service (API/Auth/GUI) Image Registry Trusted Content Vulnerability Scanning Job Service Admin Service Harbor components 3rd party components SQL

analysis Fraud & spam detection DDoS protection Application performance monitoring Logs & metrics Security events and logs. SIEM Analytics of corporate networks Telemetry Industrial monitoring Sensor data

run steady and persistent nodes for this platform? Two Major Problems ➔ End user drives, no security (or token fund) drives. ➔ Network is like a living creature, it will evolve – grow or die. The

need… • a Service Mesh, but to secure it I need… • an automated Certificate Authority, and for more security I need… • a Container scanning and monitoring service, and to monitor it more I need… • a Log Aggregation

O p s / 平 台 运 维 • I T / 基 础 设 施 • 测 试 / 安 全 团 队 持续测试 (Continuous Testing) 持续安全 (Continuous Security) 软件研发核心工程实践：交付工程 CI/CD 开发者实践 软件研发核心工程实践：全流程质量工程实践 - 持续测试 CT/ 持续安全 CS 协 同 特 点 ： • 流 程 可 定 义

Appium Easy to write tests Single code base for both platforms Extended gesture and action support Image comparison Device management Reporting nativescript-dev-appium Installation npm install nat waitForNotExist() getAttribute() source() size() location() exists() text() Typings Async/Await Image Comparison driver.compareScreen("page.png"); Open source cloud builds - Sauce Labs nativescript-facebook