CLOUD NATIVE SECURITY

Meta-(ta)rget

Build vulnerable environments like installing software

Bring specific Docker, Kubernetes, and Linux versions together with application targets. Metarget is an open source project I created while working at NSFOCUS Xingyun Lab, helping practitioners prepare environments for cloud native security testing.

Explore scenario construction View the project

INDUSTRY / OPEN SOURCE · ORIGINAL ENVIRONMENT DIAGRAM

01 / INFRASTRUCTURE AS A TARGETCONCEPTUAL VIEW

Industry · Open source

NSFOCUS / Xingyun Lab

YAML

Reusable scenario definitions

Apache 2.0

Open code, shared scenarios

OID Asia 2021

Project talk at OpenInfra Days Asia

01 / BUILT FROM PRACTICAL FRICTION

Before testing, build the environment

Testing a vulnerability may be quick. Finding versions, installing components, and configuring a suitable system can take much longer across a cloud native stack.

01 / INFRASTRUCTURE

An app image covers only part of the stack

Applications fit into images. Host-side Docker, Kubernetes, and the shared kernel still need preparation. Metarget brings these layers into scenario construction.

02 / TEST CONDITIONS

Versions and configurations both matter

Specific versions, privileged Pods, and sensitive mounts all define test conditions. Scenario definitions express their class and dependencies for the appropriate installer or deployer.

03 / COMPOSITION & REUSE

Turn preparation into reusable recipes

Layer application targets onto prepared infrastructure to form a multilayer environment. Named scenarios can be reused for reproductions, security training, and defensive validation.

02 / SCENARIO WORKBENCH

Choose a recipe and locate its target layer

Switch between kernel, runtime, Kubernetes, and privileged Pod scenarios. Inspect the recipe, dependencies, and target layer. Click a construction step or an environment layer to learn more.

METARGET / SCENARIO → DEPENDENCIES → ENVIRONMENTRECIPE DEMO / NO INSTALLATION

CHOOSE A REAL RECIPE

CVE-2022-0847Recipe source ↗

name: cve-2022-0847
class: kernel
type: container_escape
dependencies:
  - name: kernel
    version: "5.8"

Read the YAML for CVE-2022-0847 from the scenario directory. Its name, class, and dependencies describe a recipe the tool can process.

CORRESPONDING CLI COMMAND / DISPLAY ONLY

./metarget cnv install cve-2022-0847

Linux host kernel

Containers share the host kernel. Kernel scenarios require the specified kernel packages and a reboot into the target version.

Prerequisites
A compatible Ubuntu release; root; reboot after installation

Recipe output
The specified kernel packages and boot configuration

Choose a recipe to inspect its build planBrowse source recipes ↘

Original demonstration based on repository YAML and installer/deployer code. The browser displays recipes and flow without installing components or running a PoC. Preparing an environment and triggering a vulnerability are separate steps. cnv.py ↗ · kernel_installer.py ↗

03 / INTERFACES FOR ENVIRONMENT PREPARATION

Three interfaces, two preparation paths

Scenario names are entry points; versions and resource manifests guide preparation. Version tasks go to installers, while configuration and application tasks go to the Kubernetes resource deployer.

gadget

Choose a component and version

Choose a known component version to prepare the base environment. Docker, Kubernetes, or the kernel can also be managed individually.

docker --version 18.03.1Component installer → host

cnv

Prepare infrastructure from a recipe

Load YAML from vulns_cn and dispatch by class. Install specified component versions or deploy Pods with risky configurations and mounts.

name + class + dependenciesInstaller / Pod resource deployment

appv

Add applications to an existing cluster

Read the resources listed in an application’s desc.yaml and apply them to an existing cluster. The --external option generates a NodePort configuration.

Deployment + ServiceResource deployer → Kubernetes

Scenario definitions are read with YAML SafeLoader; the deployer creates the metarget namespace before applying resources. Implementations: vuln_loader.py ↗ · internal.py ↗

04 / SCENARIOS YOU CAN VERIFY IN CODE

From component vulnerabilities to apps and configurations

Select a scenario to inspect its declared dependencies and prerequisites. These are eight selected repository recipes; the visualization does not validate a live installation.

Showing 8 selected recipes / 8 examples; not the full repository catalog

SCENARIO RECIPE / SOURCE SNAPSHOT

CVE-2019-5736

The recipe installs Docker 18.03.1 to prepare a runtime for studying the runC container escape. It does not declare a separate runc package dependency.

class: docker/runc
Dependencies: docker-ce: 18.03.1
Prerequisites: Ubuntu; root access; available package sources

Open the corresponding recipe ↗vulns_cn/docker/cve-2019-5736.yaml

Recipes and code checked on 2026-10-10, using source snapshot 3cd1d62 ↗. Declared versions do not guarantee installation on every system. Distribution, package sources, images, and reboot requirements still apply.

05 / GO TO THE SOURCE

Put prepared environments to work in security practice

Metarget: Auto-Construction of Vulnerable Cloud Native Infrastructure. The industry talk at OpenInfra Days Asia 2021 presents the project, practical scenarios, and defensive value. The write-up and repository document its design and usage.

Bonan Ruan · NSFOCUS Xingyun Lab · Industry / Open source

Real deployment changes system components and requires root access. Use a dedicated test environment and follow the repository’s guidance on system versions and isolation.

Source repository GITHUB / OPEN SOURCE ↗ Project write-up WP ↗ Presentation slides OID Asia 2021 ↗ Installation & usage README ↗

Inspect a multilayer command example

./metarget cnv install cve-2019-5736
./metarget cnv install cve-2018-1002105
./metarget cnv install privileged-container
./metarget appv install dvwa --external

Four commands selected from the README’s multilayer example prepare the runtime, orchestration, a configured Pod, and an application. Real deployment requires checking the system and each step’s prerequisites; these commands do not execute exploits.