osquery in Docker environment

Question

I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security dilemma that I would like some thoughts and feedback on:

Running osquery on every Docker container in the infrastructure would give excellent situational awareness, but unfortunately osquery can't run on the slimmed-down, security-focused Alpine Linux distro, which means that the entire fleet of Docker containers would need to be based on much more bloated images like Debian or Ubuntu with a much larger attack surface and possibilities for an attacker, if they gain access to a container.

Is it common practice to put osquery on containers, or should they simply be treated as dumb cattle with minimal attack surface which can be shot if showing signs of weirdness, and then have advanced monitoring on the Docker host machines instead?

Answer 1

Docker is never targeted security and privilege separation. The targeted goal of Docker is to be able to quickly install and deploy containers for anything, on anything.

For this reason, it is a common practice to put anything into docker containers, including security tools, but it is not hardened against breaking out from a container into the physical machine (although doing this is harder as it seems).

It is not a common practice that you download a docker container, write a 10 line long script on it and it will work like charm. Yes, this is what docker offers, but it doesn't fulfill it. Its main reason is the security - not being really security-hardened, they need to disable a lot of important linux kernel features (for example, they've simply disabled the unix datagram sockets, this is why syslogd doesn't work very well in docker containers).

If osquery works on an least two different distro families (deb- and rpm based ones), then yes, it should work also on Alpine. But it is your task to make it work.

So sure, you can make osquery work, but it won't be easy. You will have to dig deeply both into osquery, alpine, and docker. As a result, you will be able to build an osquery docker container, what you will be able to use as a base for your further developments.