1

A number of answers here on this Stack Exchange argue that containers are inherently insecure and one should never run untrusted code in a container, let alone run a container built entirely by someone else.

And yet, there are a number of companies currently offering AWS-style VPS services that use containers instead of virtualization.

Of course, unless you run your own private datacenter with armed guards and don't connect it to the internet, no VPS or rented server is perfectly secure. For containers to be relevant, the possibility of attack doesn't need to be zero, it just needs to be sufficiently small compared to the attack vectors of alternative services.

So the question is: just how safe can containers be? Are there container systems (if so, which ones) which have no known exploits currently, and for which exploits are likely to be fairly hard to craft?

And one specific aspect of the question: At worst, is there any container system in which running an untrusted container can be considered as safe as running un-containerized code as an unprivileged user?

5
  • 2
    Some of the current hot items around security of containers revolves around the memory sharing model. Apparently on some of these systems you can easily access all of the system memory areas which means you could grab all the passwords or keys used by applications in the other containers. This is considerably worse than the security issues for other types of virtualization. Perfect security is an illusion at best, don't focus on that. I think the answer to your last question is currently "no". BTW: I do expect container security to improve over time. May 4, 2016 at 21:57
  • wat?!. What linux containerization solution weakens overall linux security such that you can grab all secrets from other containers? Jun 21, 2016 at 16:55
  • @RоryMcCune: I suppose he was referring to Row Hammer attacks. Jun 21, 2016 at 17:06
  • @WhiteWinterWolf I guess that could be it, although AFAIK that's not specific to containerization, that would hit virtualized systems as well ... Jun 21, 2016 at 17:43
  • @RоryMcCune: Actually I'm wondering if it would really hit virtualized systems too, I've just created a new question about this :) ! Jun 22, 2016 at 10:01

1 Answer 1

0

It's quite difficult to discuss containerization security in isolation as essentially the isolation features provided are functions of the Linux kernel (assuming we're talking here about projects like LXD, Docker and Rkt).

It's fair to say that an application in a container on a host is not likely to be less secure than the same application running on outside the container on the same host.

I'd suggest that a well configured container can add considerable security to the overall solution when compared to uncontained processes.

Features such as Linux namespaces, cgroups, capabilities, syscall filtering and Mandatory access control systems (such as AppArmor or SELinux) can all be utilized to help secure processes running in a container.

In a lot of cases it depends on how much effort the operator is willing to put into configuring the container security. The defaults of these projects tend to favour ensuring that most apps will work seemlessly rather than focusing on absolute security, so there's quite a bit of scope for hardening to be done.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .