Questions tagged [container]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
184 views

Android Certificate Revocation Checking

I am hoping I can leverage everyone's knowledge on this one as I am at a lose. I have an Android 10 Device connecting to a containerized web application that is secured by a custom Certificate ...
Elliot's user avatar
  • 11
1 vote
0 answers
204 views

Is a docker container that requires "clone" and "unshare" syscalls of any use?

I am not very skilled at linux and besides reading about clone and unshare I would love to have some second opinion on the situation: The setup A process I intend to run is an automated "chrome ...
Samuel's user avatar
  • 728
0 votes
1 answer
433 views

Why is it safer to run as non-root inside a single-user container that is deployed with rootless podman?

According to the JellyFin documentation Podman doesn't require root access to run containers, although there are some details to be mindful of; see the relevant documentation. For security, the ...
Evan Carroll's user avatar
  • 2,813
0 votes
1 answer
114 views

Security issues with cgroup device access in privileged container

I'm currently working on a project where I need to edit a runc configuration to stop allowing for wildcard cgroup device access inside the container, or essentially writing below to devices.allow. ...
Acohen's user avatar
  • 1
1 vote
1 answer
934 views

Mounting secrets with proper access control in kubernetes pods

I am trying to mount a secret in the pod securely. I have created the secrets with defaultMode: 0400 and runAsUser:1000. However when i am trying to access the secret in the container after doing exec ...
warrior-oo7's user avatar
1 vote
0 answers
179 views

Is using a singularity sandbox an effective way to increase security through isolation / compartmentalization?

I am using singularity sandboxes in my workflow for several reasons unrelated to security. However, after using it a bit, I am now wondering: is using a singularity sandbox an effective way to ...
Zorglub29's user avatar
  • 297
49 votes
3 answers
37k views

Is RAM wiped before use in another LXC container?

Edit: though my wording may not be exact, I understand that two containers don't have access to the same memory at the same time. My question is can one container see data that another has deallocated?...
coolaj86's user avatar
  • 593
2 votes
1 answer
150 views

What're the most common vulnerabilities/weaknesses an attacker would exploit to gain SSH access to a container?

Fair warning - I am a security newbie. In all container escape/breakout vulnerability scenarios I've read (CVE-2022-0185), the author assumes or states that the attacker already had shell or SSH ...
Patrick Burke's user avatar
4 votes
0 answers
241 views

What are the potential vulnerabilities with containerized rootless Chrome and --no-sandbox?

I'm evaluating running Chromium without native sandboxing in a rootless container. A few points: You can containerize Chrome using rootless containers with something like podman. This will utilize ...
Evan Carroll's user avatar
  • 2,813
0 votes
0 answers
400 views

Why am I able to access EC2 metadata endpoint from within a Docker container running in the EC2

My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether ...
qre0ct's user avatar
  • 1,522
1 vote
1 answer
563 views

What is the easiest way to find non-vulnerable container images?

I am fairly new to container image vulnerability scanning. There seem to be a lot of tools (Snyk, Trivvy, Clair, e.g.) that can identify vulnerable packages in container images. They also do a good ...
Scott McNeany's user avatar
0 votes
1 answer
378 views

Capabilities DROP in container of Kubernetes pod running with specific UID

I am doing some security research on Kubernetes and I found something still mysterious to me, concerning capabilities. Example of simple pod: apiVersion: v1 kind: Pod metadata: name: my-pod-httpd ...
cactuschibre's user avatar
1 vote
0 answers
280 views

Can a container with CAP_NET_ADMIN access the host namespace

I have a docker container that I run by adding the extra privilege of CAP_NET_ADMIN in addition to the default ones. If I don’t share the host net namespace with the container, the host namespace is ...
ayushman999's user avatar
2 votes
2 answers
1k views

In practice, how should you run privileged or 'root' container?

Running a container as root is a big "no" but are there times we really need to run privileged pods, or sometimes as root? If so (and feel free to disagree), what are the mitigation controls ...
transcend3nt's user avatar
1 vote
1 answer
363 views

Why do we use SELinux Policies as it overlaps other controls such as Linux Namespaces, K8S/Container security?

While learning SELinux policies in the Container/Kubernetes environment, I realized that there are other layers of controls that overlap with SELinux. In these cases, what additional value can I can ...
transcend3nt's user avatar
3 votes
1 answer
1k views

What does default Seccomp, AppArmor and SELinux in Kubernetes Security mean?

What does default Seccomp, AppArmor, and SELinux in Kubernetes Security truly mean? Who and where provides the default profile? Does default mean it applies to containers, pods, or the Kubernetes ...
transcend3nt's user avatar
2 votes
1 answer
245 views

How does Kubernetes Pod Security Standard (PSS) differ from Pod Security Policies (PSP) from design?

Why are we replacing PSP with PSS? What are the motivations and changes in fundamental design? Both PSS and PSP's objective is to only permit Pods that fulfill a set of secure criteria and conditions ...
transcend3nt's user avatar
-1 votes
1 answer
309 views

Modifying cacerts at runtime

I have an containerized JVM application (multiple actually) running on kubernetes, which needs to trust additional custom/private CAs (which are not known beforehand, the application will be deployed ...
ciis0's user avatar
  • 101
2 votes
1 answer
361 views

Container escape - CVE-2022-0492 - hybrid cgroups?

I saw the recent CVE-2022-0492 that can enable container escape, and I have a decent understanding of cgroups and container capabilities, but not very familiar with how hybrid cgroup v1/v2 works, nor ...
4oo4's user avatar
  • 125
3 votes
2 answers
737 views

Security of untrusted Docker containers

If I want to run untrusted code inside a Docker container, or an untrusted Docker container for that matter, how can I restrict it? I'd like to make sure it has no access to the host filesystem. ...
SRobertJames's user avatar
0 votes
1 answer
141 views

Does Log4Shell ("CVE-2021-44228 ") affect K8S/Containers and function-as-a-service (FaaS)?

Does Log4Shell ("CVE-2021-44228") affect K8S/Containers and/or function-as-a-service (FaaS) running image with affected log4j? I would like to understand if this vulnerability affects ...
Nathan Aw's user avatar
1 vote
1 answer
2k views

Certificates generated by internal CA show Verification error: self signed certificate and other errors when using curl against URL

I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-...
user3783793's user avatar
0 votes
1 answer
446 views

Why Vulnerability Scanners Ignore Shared Libraries?

First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
Artem A.'s user avatar
0 votes
0 answers
60 views

How to protect workload from host [duplicate]

I have some code and other resources which run in a container or VM ("black box") on a host machine. The host uses this as a service to process some files which are highly sensitive and ...
Alex's user avatar
  • 109
1 vote
2 answers
188 views

Logging docker container logins, EC2 Host

I have an AWS EC2 instance with docker installed, running a default nginx container - docker run -it --rm -d -p 8080:80 --name web nginx. I have an rsyslog setup that successfully captures the auth....
dzzl's user avatar
  • 11
2 votes
0 answers
120 views

Are there any security advantages to using Kernel Keyring versus the default file based caches for Kerberos on Linux? [closed]

In a containerized environment, what would be the most appropriate way of configuring Kerberos caches?
sa___'s user avatar
  • 131
5 votes
2 answers
901 views

Are Ubuntu Snaps more secure than the classic installation method from the official repos?

Today Ubuntu (and some other distros) offer a new way to install software, which is snaps. It's software packaged with all its dependencies, run with some kind of containerization, and auto-updated. ...
reed's user avatar
  • 15.8k
1 vote
1 answer
172 views

Do I need to keep production Docker/container images?

Context My company is developing a SaaS solution that needs to conform to PCI-DSS L1 for sure, and possibly FedRAMP and other frameworks later. We can do continuous deployment with feature flagged/...
aries1980's user avatar
1 vote
2 answers
165 views

Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?

Can a meltdown attack also violate data integrity of other processes by obtaining different passwords or is it just violating data secrecy by reading data it is unauthorized to do?
Minh Nguyen Nhat's user avatar
0 votes
0 answers
32 views

secure deletion in virtual machines [duplicate]

when we securely delete a volume in a machine which is installed in a virtual machine or docker, for example by overwriting 7 times or more, we securely delete the data in virtual disk (in guest) and ...
alex's user avatar
  • 1
2 votes
1 answer
207 views

Container Vulnerability Management

Having difficulty understanding how to translate 'traditional' vulnerability management to a cloud environment. Previously accustomed to using tools like OpenVAS and Nessus, setting up scans which ...
Scot Matson's user avatar
1 vote
0 answers
132 views

Linuxcontainers » LXC : Security Vulnerabilities

I have a question regarding Linuxcontainers. How do you classify the security vulnerability mentioned here, more specifically the ones that ends with 6441,1331,1134,1335 and 10124. I mean are they a ...
learner 's user avatar
1 vote
2 answers
3k views

Requesting an SSL certificate without a CSR, can it be done?

Please excuse me if this is a dumb or obvious question, I'm self taught and have not been able to find an exact answer to my question after much Googling and reading through StacEx! I'm having issues ...
Chris Butler's user avatar
1 vote
0 answers
136 views

Running non-root process in docker vs bare metal

Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container. Reasoning behind that is that ...
Lapsio's user avatar
  • 217
1 vote
2 answers
643 views

Hiding text string with steganographic method - practical problem

I'd like to ask for small hint with following problem: Using the steganographic method of the least significant bits, hide the text string "Kra" in four pixels of color with RGB code . Hide ...
Filip CZ's user avatar
1 vote
1 answer
188 views

Build and execute code on a sandboxed environment?

Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
nowox's user avatar
  • 367
2 votes
1 answer
583 views

What disadvantages running untrusted applications in anbox has over running them in a virtual machine?

I consider running Android applications in Anbox instead of running them in a virtual machine (Android-x86 in GNOME Boxes using QEMU with KVM). Does it increase the chances that malicious code in an ...
Roman Riabenko's user avatar
0 votes
1 answer
2k views

Can malicious applications running inside a docker container still be harmful? [duplicate]

I am very new to docker (and don't usually program at a 'systems' level). I will be working on an open source project with complete strangers over the web over the next couple of months. I trust them, ...
dss's user avatar
  • 103
2 votes
1 answer
1k views

Podman: What if user is member of docker group?

From a security perspective: Is it necessary that a user, that runs OCI containers with Podman, is not at the same time a member of the docker group? From what I understand the idea behind Podman is ...
dotcs's user avatar
  • 121
2 votes
1 answer
161 views

Is uncompromisable obfuscated x86-64 execution possible?

I have a problem which has several layers; Provide a distributed computing plane where actors can voluntarily add and remove computing resources from, the actors are untrusted by default, and thus ...
Shadowjonathan's user avatar
4 votes
1 answer
770 views

Secure Communication between Swarm Worker Nodes

I have a Swarm Cluster and want to communicate securely between Windows Worker Nodes. The official Docker Documentation (https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/) states: The ...
D.O.'s user avatar
  • 610
5 votes
1 answer
4k views

What are the best practices for anti-virus / anti-malware when using containers?

One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
Roly's user avatar
  • 153
11 votes
1 answer
20k views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
Shuzheng's user avatar
  • 1,237
4 votes
0 answers
2k views

How safe is it to enable unprivileged user namespace: unprivileged_userns_clone [duplicate]

Linux user namespaces are special, as they play the role of the owner of the other namespaces. Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled. For ...
miku's user avatar
  • 141
1 vote
1 answer
454 views

Virtualized or Container (Remote) Based Browser Isolation is more secure?

There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.
Filipon's user avatar
  • 1,264
1 vote
2 answers
196 views

Secure browsing on any device without limiting the browser

The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation. Employees depend ...
Peter_Sw's user avatar
2 votes
1 answer
1k views

Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails? Specially, can an attacker escape ...
z1naOK9nu8iY5A's user avatar
57 votes
2 answers
10k views

If a container is compromised does that mean host also compromised?

Recently, I have heard of a new virtualization tech called containers. Suppose the container has been compromised, does this mean the host is also compromised (since the container is a process on a ...
Akhil Surapuram's user avatar
2 votes
1 answer
801 views

Containerization vs. Chroot in shared hosting

Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
armadadrive's user avatar
1 vote
1 answer
205 views

Security (IP discovering) on Kubernetes

I'm trying to improve my security knowledge on containers environments. Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
OscarAkaElvis's user avatar