TechPrufer
Get started
Replicate
Replicate logoReplicate · Feature trail

Network Security and Isolation

1 post · May 2024

What this trail covers

Replicate has implemented enhanced network security measures for model containers, including encrypting all internal traffic and restricting privileged network access. This follows the disclosure of a vulnerability where model containers could eavesdrop on internal communications due to shared network namespaces and unencrypted traffic. The company has mitigated this by dropping NET_ADMIN and NET_RAW capabilities from model containers and encrypting all internal TLS traffic.

All Replicate trails
  1. Shared network vulnerability disclosureThis post details a security vulnerability where model containers could eavesdrop on internal traffic due to shared network namespaces and unencrypted communication between model containers and their 'director' processes. The vulnerability was mitigated by dropping NET_ADMIN and NET_RAW capabilities from model containers, preventing privileged network access, and by encrypting all internal TLS traffic between model pods and Replicate's internal networks.