4

Should the traffic between two containers in same docker environment need to be encrypted ?

Is it possible for a container to snoop into the un-encrypted traffic between two containers ?

4

Whilst it depends slightly on the nature of the environment in use, in the general case I'd say that you likely do want to encrypt traffic between two containers.

In a default Docker setup (e.g. no fancy overlay networks to consider), containers communicate with each other over the default Docker bridge. Also by default containers are assigned the NET_RAW privilege which means that amongst other things they can try to carry out things like ARP spoofing attacks (there are details of this in this whitepaper from Jesse Hertz

So if you use unencrypted communications between 2 containers, then there is a risk that a third, malicious, container running on the same host could try and sniff the traffic between your two containers.

How realistic that threat scenario is, will entirely depend on your application.

| improve this answer | |
1

As other answer have pointed out, it is indeed possible to sniff traffic in a container-to-container communication by a third container. Even if it would have been safe however (for example if you trust the host and all its container) all dockers are expected to be able to be migrated almost seamlessly from one host to another.

Althought this is not the case "now", it may happen in the future that they are indeed migrated in different machines, and you (or worse, a different administrator which doesn't know about application logic) may not remember that traffic is not encrypted on planning that.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.