1

A number of answers here on this Stack Exchange argue that containers are inherently insecure and one should never run untrusted code in a container, let alone run a container built entirely by someone else.

And yet, there are a number of companies currently offering AWS-style VPS services that use containers instead of virtualization.

Of course, unless you run your own private datacenter with armed guards and don't connect it to the internet, no VPS or rented server is perfectly secure. For containers to be relevant, the possibility of attack doesn't need to be zero, it just needs to be sufficiently small compared to the attack vectors of alternative services.

So the question is: just how safe can containers be? Are there container systems (if so, which ones) which have no known exploits currently, and for which exploits are likely to be fairly hard to craft?

And one specific aspect of the question: At worst, is there any container system in which running an untrusted container can be considered as safe as running un-containerized code as an unprivileged user?

  • 2
    Some of the current hot items around security of containers revolves around the memory sharing model. Apparently on some of these systems you can easily access all of the system memory areas which means you could grab all the passwords or keys used by applications in the other containers. This is considerably worse than the security issues for other types of virtualization. Perfect security is an illusion at best, don't focus on that. I think the answer to your last question is currently "no". BTW: I do expect container security to improve over time. – Trey Blalock May 4 '16 at 21:57
  • wat?!. What linux containerization solution weakens overall linux security such that you can grab all secrets from other containers? – Rоry McCune Jun 21 '16 at 16:55
  • @RоryMcCune: I suppose he was referring to Row Hammer attacks. – WhiteWinterWolf Jun 21 '16 at 17:06
  • @WhiteWinterWolf I guess that could be it, although AFAIK that's not specific to containerization, that would hit virtualized systems as well ... – Rоry McCune Jun 21 '16 at 17:43
  • @RоryMcCune: Actually I'm wondering if it would really hit virtualized systems too, I've just created a new question about this :) ! – WhiteWinterWolf Jun 22 '16 at 10:01
0

It's quite difficult to discuss containerization security in isolation as essentially the isolation features provided are functions of the Linux kernel (assuming we're talking here about projects like LXD, Docker and Rkt).

It's fair to say that an application in a container on a host is not likely to be less secure than the same application running on outside the container on the same host.

I'd suggest that a well configured container can add considerable security to the overall solution when compared to uncontained processes.

Features such as Linux namespaces, cgroups, capabilities, syscall filtering and Mandatory access control systems (such as AppArmor or SELinux) can all be utilized to help secure processes running in a container.

In a lot of cases it depends on how much effort the operator is willing to put into configuring the container security. The defaults of these projects tend to favour ensuring that most apps will work seemlessly rather than focusing on absolute security, so there's quite a bit of scope for hardening to be done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.