I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my container through the IP address and gain a shell to my container? If yes can the attacker cat the contents of the secret file which is mounted?


Short answer: yes. The Docker documentation says:

Secrets are encrypted during transit and at rest... Here

, which is exactly what it is supposed to be. And rest in this case means: While it is not used by the docker container.

But if your running software needs to read the secrets (such as an SSH key) it has to be decrypted. This means that in every case the secret gets mounted to a docker container it will be decrypted. And given this scenario every attacker who has shell access will be able to read this as well. This is not what docker tries to protect you from. See also: Docker Secrets

|improve this answer|||||
  • 1
    However, with docker it should be easy to create a service that does indeed not have a shell to break out to. – Tobi Nary Nov 16 '17 at 16:43

If an attacker roots your container I would say that he is able to see what's inside the file, since according to the documentation, the file is mounted unencrypted on the container:

When you grant a newly-created or running service access to a secret, the decrypted secret is mounted into the container in an in-memory filesystem. The location of the mount point within the container defaults to /run/secrets/ in Linux containers, or C:\ProgramData\Docker\secrets in Windows containers. You can specify a custom location in Docker 17.06 and higher.

It also says that:

You can update a service to grant it access to additional secrets or revoke its access to a given secret at any time.

Maybe you could revoke access after your process loaded the secret in memory so the file is not attached to the container anymore.

Link to the documentations for 17.09 https://docs.docker.com/engine/swarm/secrets/#how-docker-manages-secrets

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.