WhoC: Peeking Under the Hood of Container-as-a-Service Offerings

The Black-Box Trust Model in Containers-as-a-Service (CaaS)

Enterprises deploy business-critical applications on multi-tenant CaaS platforms (like AWS Fargate and Azure Container Instances), trusting providers to enforce strict workload isolation.

Introducing WhoC: Container Runtime Extraction

Yuval Avrahami presents WhoC, an open-source container image designed to extract the underlying container engine binary running on host infrastructure.

Exploiting File Descriptor Leaks During Container Initialization

Avrahami explains how WhoC exploits subtle race conditions and leaked file descriptors in container runtimes (such as runc) to inspect host-level execution environments.

Auditing Public Cloud CaaS Security Boundaries

The author shares research findings across major cloud providers, highlighting how runtime transparency helps researchers identify container escape zero-days.