1

I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my container through the IP address and gain a shell to my container? If yes can the attacker cat the contents of the secret file which is mounted?

4 Answers 4

3

Short answer: yes. The Docker documentation says:

Secrets are encrypted during transit and at rest... Here

, which is exactly what it is supposed to be. And rest in this case means: While it is not used by the docker container.

But if your running software needs to read the secrets (such as an SSH key) it has to be decrypted. This means that in every case the secret gets mounted to a docker container it will be decrypted. And given this scenario every attacker who has shell access will be able to read this as well. This is not what docker tries to protect you from. See also: Docker Secrets

2
  • 1
    However, with docker it should be easy to create a service that does indeed not have a shell to break out to.
    – Tobi Nary
    Nov 16, 2017 at 16:43
  • Worth noting that Docker Secrets are only available where you're using Docker Swarm, not in Docker Engine. Jul 29, 2020 at 9:39
3

If an attacker roots your container I would say that he is able to see what's inside the file, since according to the documentation, the file is mounted unencrypted on the container:

When you grant a newly-created or running service access to a secret, the decrypted secret is mounted into the container in an in-memory filesystem. The location of the mount point within the container defaults to /run/secrets/ in Linux containers, or C:\ProgramData\Docker\secrets in Windows containers. You can specify a custom location in Docker 17.06 and higher.

It also says that:

You can update a service to grant it access to additional secrets or revoke its access to a given secret at any time.

Maybe you could revoke access after your process loaded the secret in memory so the file is not attached to the container anymore.

Link to the documentations for 17.09 https://docs.docker.com/engine/swarm/secrets/#how-docker-manages-secrets

2

Salt the secret using your own technique, taking inputs from the docker metadata, the environment, arguments or environment variables, etc. then use md5 and docker inspect to gather the info needed to salt it locally, save it as a salted secret locally, on the container only someone knowing the unsalt technique would be able to compromise it, in theory only by running the command with md5 itself. Sometimes the application has the md5 algorithm embedded in it (databases come to mind) meaning you could uninstall md5 tools from the OS layer and it should still be usable. In short, keep it a bit more challenging and unpredictable.

1

A secret used by a container is typically some type of credential needed by the contained process to authenticate to another service (e.g. an API key or credentials for a database).

If the container is compromised an attacker will have access to anything the contained process had access to ,which is necessarily going to include that secret. So the answer to your question is yes.

This is no different to any other application. If you compromise a PHP application running in a VM, you'll get access to any information that process can see.

Secrets management security for containers is more focused on ensuring that only the containers that should be able to see a secret can, and also about ensuring that the secrets are encrypted on disk, so that an attacker who gains access to the filesystem used by the secrets management service can't necessarily gain access to the secret data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .