Dostainer – Kubernetes Resource Exhaustion PoC Container
GitHub - uchi-mata/dostainer
Dostainer - Kubernetes Resource Exhaustion PoC Container
This container contains three scripts to demonstrate resource exhaustion from within a Kubernetes clusters:

Allocate all remaining RAM
Allocate all remaining disk space
Fork bomb all the things! (on courtesy of Chris who also demonstrated that in one of our last presentations)

Those exhaustion attacks work in many K8s environments as default settings do not include proper resource limits - and each of those can/does render one node useless (which will eventually upon pod failover spread through the cluster).
Hardening measures are added to dosploy.yaml and listed below:

Memory Restrictions
Ephemeral Storage Limits

Keep in mind that storage limits may not apply to other volumes attached to a pod.


Pod PID Limit

The PID limit is configured on the kubelet level and applies to all pods, i.e. you cannot configure individual PID limits per pod.



