2

For a web server that handles 100% of incoming traffic with Docker containers is it necessary to apply security updates to the host (other than kernel and Docker updates)?

1

Absolutely, yes! It is worth reading this link that also maintains the view that you should ensure your host is fully patched with latest versions of your OS software components: https://www.oreilly.com/ideas/docker-security

Concur with Rory re: attack surface reduction, i.e. minimal / lightweight host packages installed.

Of course it would help to provide an example of what can happen if you don't, though a browse of CVEs should remind you of the issues around container breakouts and how they can be achieved: http://www.cvedetails.com/vulnerability-list/vendor_id-13534/product_id-28125/year-2017/Docker-Docker.html

A more thorough guidance on docker hardening can be found here: https://success.docker.com/Architecture/Docker_Reference_Architecture%3A_Securing_Docker_EE_and_Security_Best_Practices

| improve this answer | |
4

In general it is a good idea to apply any available security patches for a host you're running. In the case of a Docker host, whilst packages outside of docker and the kernel might not be directly exposed they may come into play if, for example, an attacker gets unprivileged access to the host.

What you can do is look to reduce the number of patches you'll need to apply by reducing the number of packages installed on the host.

If the host literally is just running Docker containers, you could look at something like linuxkit or RancherOS which can create a stripped down base installation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.