1

I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security dilemma that I would like some thoughts and feedback on:

Running osquery on every Docker container in the infrastructure would give excellent situational awareness, but unfortunately osquery can't run on the slimmed-down, security-focused Alpine Linux distro, which means that the entire fleet of Docker containers would need to be based on much more bloated images like Debian or Ubuntu with a much larger attack surface and possibilities for an attacker, if they gain access to a container.

Is it common practice to put osquery on containers, or should they simply be treated as dumb cattle with minimal attack surface which can be shot if showing signs of weirdness, and then have advanced monitoring on the Docker host machines instead?

  • Uptycs claims commercial support for osquery on docker -- uptycs.com/blog/… -- but if you are looking for something more-native, check out Sysdig Falco, eBPF, etc – atdre Dec 13 '18 at 18:11
1

Docker is never targeted security and privilege separation. The targeted goal of Docker is to be able to quickly install and deploy containers for anything, on anything.

For this reason, it is a common practice to put anything into docker containers, including security tools, but it is not hardened against breaking out from a container into the physical machine (although doing this is harder as it seems).

It is not a common practice that you download a docker container, write a 10 line long script on it and it will work like charm. Yes, this is what docker offers, but it doesn't fulfill it. Its main reason is the security - not being really security-hardened, they need to disable a lot of important linux kernel features (for example, they've simply disabled the unix datagram sockets, this is why syslogd doesn't work very well in docker containers).

If osquery works on an least two different distro families (deb- and rpm based ones), then yes, it should work also on Alpine. But it is your task to make it work.

So sure, you can make osquery work, but it won't be easy. You will have to dig deeply both into osquery, alpine, and docker. As a result, you will be able to build an osquery docker container, what you will be able to use as a base for your further developments.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.