Tag Info

Hot answers tagged

19

At the moment there is no way to easily work out whether to trust specific docker containers. There are base containers provided by Docker and OS providers which they call "trusted" but the software lacks good mechanisms as yet (e.g. digital signing) to check that images haven't been tampered with. For clarification to quote the recently released CIS ...


7

Trust it as much as any unsigned code that you run on your systems. Containers are just processes with some extra namespace protections on them, so that's all the protections they get. They still talk to the same kernel underneath.


5

In essence, I argue it is the same question as whether open source software is trustworthy. But I think the risk of using community Docker containers is somewhat higher at present than the risks of using open source software. First, as you mentioned, there is no signing and verification now. Good open source packaging systems today include this, at least ...


4

It's best to consider a Docker container to be the same as running an application on the host system. There are some attempts to lock down the Docker daemon by removing Linux Kernel capabilities, but this is not really a guarantee. If you do run Docker, there are a few things you can do to help mitigate some of this risk. SELinux - Enabling this will ...


1

It seems that this question did not attracted a lot of attention, however being still curious on the subject, wanting to know an answer and having a few spare time I decided to roll up my sleeves and check this by myself :). First thing first, true PID randomness is indeed a cause of security weakness. "PID randomness" is designed to bring better security ...


1

When you type "sudo [software]", it will Always assume the software needs admin rights. Thus, the OS will ask for the password, Before the process [software] has a chance to run at all. However, you have a risk, and that is when you have sudo set to "remember" your authorization for a preset time. This is default behaviour, and I Think the time is set to 5 ...


1

how is such a hack tool guarded against? Prevent your computer to boot from an external media by setting appropriate options at the BIOS level and protecting this configuration using a BIOS password, Use Trusted Boot where TPM chip is available (most professional laptops have one, this Dell Latitude has one), Use full disk encryption, this ...


1

You can build trust in the source by a quick investigation but a more fundamental concern is the relative immaturity of the overall security profile as suggested by the need to use root access to run your container. Since you suggest we focus on popular solutions let's consider that we are using a controlled Git based repository like Docker Hub to pull down ...



Only top voted, non community-wiki answers of a minimum length are eligible