Docker Discuss Docker Security discussion

eva2000 · Feb 21, 2015

Discussion thread for Docker security and links to articles related to security with Docker containers.

Links

Security Risks and Benefits of Docker Application Containers

Guilherme Jaccoud · Feb 23, 2015

Here's a nice guide for hardening Docker containers. It would be nice if we could use this thread to share resources of same nature

Hardening Docker Containers: Disable SUID Programs | Tutum Blog

Guilherme Jaccoud · Feb 23, 2015

Security Risks and Benefits of Docker Application Containers

eva2000 · Feb 23, 2015

Thanks @Guilherme Jaccoud was next on my list of threads to create - Docker Security measures

eva2000 · Mar 21, 2015

Before you initiate a “docker pull” - Red Hat Customer Portal

interesting concern with docker pull command

In addition to the general challenges that are inherent to isolating containers, Docker brings with it an entirely new attack surface in the form of its automated fetching and installation mechanism, “docker pull”. It may be counter-intuitive, but “docker pull” both fetches and unpacks a container image in one step. There is no verification step and, surprisingly, malformed packages can compromise a system even if the container itself is never run. Many of the CVE’s issues against Docker have been related to packaging that can lead to install-time compromise and/or issues with the Docker registry.

One, now resolved, way such malicious issues could compromise a system was by a simple path traversal during the unpack step. By simply using a tarball’s capacity to unpack to paths such as “../../../” malicious images were able to override any part of a host file system they desired.

Thus, one of the most important ways you can protect yourself when using Docker images is to make sure you only use content from a source you trust and to separate the download and unpack/install steps. The easiest way to do this is simply to not use “docker pull” command. Instead, download your Docker images over a secure channel from a trusted source and then use the “docker load” command. Most image providers also serve images directly over a secure, or at least verifiable, connection. For example, Red Hat provides a SSL-accessible “Container Images”.Â Fedora also provides Docker images with each release as well.
Click to expand...
Since “docker pull” automatically unpacks images and this unpacking process itself is often compromised, it is possible that typos can lead to system compromises (e.g. a malicious “rel” image downloaded and unpacked when you intended “rhel”). This typo problem can also occur in Dockerfiles. One way to protect yourself is to prevent accidental access to index.docker.io at the firewall-level or by adding the following /etc/hosts entry:
Code:
127.0.0.1 index.docker.io
Click to expand...

Log in / Register

Forums

Want to subscribe to topics you're interested in?

Docker Discuss Docker Security discussion

eva2000 Administrator Staff Member

Guilherme Jaccoud Member

Guilherme Jaccoud Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

Docker Discuss Docker Security discussion

eva2000 Administrator Staff Member

Guilherme Jaccoud Member

Guilherme Jaccoud Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.