runc Maintainer Fubang Li Discusses ProcFS Attack Surface and Pathless Container Security Architecture
A video published on the official PyTorch channel features runc maintainer Fubang Li introducing the Pathless Container Setup (PCS) framework. The talk addresses ProcFS as a primary attack surface, explaining how Linux pathless mount APIs eliminate path resolution risks and sharing deployment practices upstreamed into runc.
ImportanceLocalEvidenceE2 unreplicatedWrite-upQuick
In a video published on the official PyTorch channel, Fubang Li, a runc maintainer and lead researcher of the Pathless Container Setup (PCS) framework, presented recent architectural evolutions in container runtime security. The talk focuses on ProcFS as the most persistent attack surface for runc container escapes, accounting for 60% of path-related CVEs between 2017 and 2025.
Li outlined the evolution of attacks from early TOCTOU symlink hijacking to modern bind mount escapes and proposed the PCS framework's file descriptor-centric design. This design leverages modern Linux pathless mount APIs (such as fsopen and fsmount) to completely eliminate path resolution risks. According to the publisher, this approach has been upstreamed into runc and deployed across global public clouds, aiming to mitigate all 9 known path-related CVEs and provide actionable best practices for hardening deployments.