Questions tagged [container]
The container tag has no usage guidance.
0
votes
1answer
48 views
Virtualized or Container (Remote) Based Browser Isolation is more secure?
There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.
1
vote
2answers
79 views
Secure browsing on any device without limiting the browser
The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation.
Employees depend ...
0
votes
1answer
71 views
Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
Specially, can an attacker escape ...
52
votes
2answers
8k views
If a container is compromised does that mean host also compromised?
Recently, I have heard of a new virtualization tech called containers. Suppose the container has been compromised, does this mean the host is also compromised (since the container is a process on a ...
2
votes
1answer
86 views
Containerization vs. Chroot in shared hosting
Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
1
vote
1answer
97 views
Security (IP discovering) on Kubernetes
I'm trying to improve my security knowledge on containers environments.
Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
2
votes
1answer
446 views
Running Docker container as Root user
Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear:
Is it still the same kind of insecure even if the container cannot ...
2
votes
3answers
329 views
Managing trusted certificates revocation in containers in as “cloud native” means as possible
This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can.
Problem statement
I'm looking for a modern best practice for managing and deploying the trusted root CA ...
4
votes
2answers
333 views
How to prevent a docker container from being attached by multiple users?
When you run docker containers you can list running containers by using docker ps
Then you can attach them by docker attach <container id>
The trouble is that all people that can attach the ...
0
votes
1answer
114 views
Is it normal to being able to kill a process from outside a container?
Situation: on user@host a qemu run and stack inside a container user@container
Is it normal:
to view with ps aux | grep qemu from user@host that the process run on user@container?
to be able to ...
0
votes
0answers
283 views
A browsing window/Tab as a Docker container Sandbox?
I want to know if there is a possibility to use browsers' Tabs and Windows as self-contained Docker images where we can benefit from more security by separating the sessions (some web browsers ...
5
votes
1answer
237 views
How secure is LXD compared to Docker?
I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?
1
vote
1answer
307 views
Option to secure docker socket from containers
Objective
Understand the options to secure the docker.sock.
Background
As in those articles, giving containers the access to docker.sock is a risk.
Don't expose the Docker socket (not even to a ...
8
votes
1answer
8k views
Docker runs container processes as root - should I be worried?
I am running a (QNAP) NAS with Docker functionality ("containerstation"). I thought it would be a lot safer to install apps via containers instead of apps from the store (or 3rd party stores).
Many ...
0
votes
2answers
336 views
Docker secret security
I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my ...
0
votes
1answer
390 views
Potential added risks of using Docker in production servers
What are the added security risks of using a dockerized container to deploy a production server?
Not interested in risks that would exist anyway in deploying a production server the traditional way,...
0
votes
1answer
166 views
Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?
I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice ...
26
votes
2answers
23k views
Is it possible to escalate privileges and escaping from a Docker container?
I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc.
I saw how easy is to get root in a docker host machine once you entered to the ...
1
vote
0answers
762 views
Are BSD jails a “huge security liability”? [closed]
In this 2014 blog post from an apparently anti-BSD blog, the author criticizes BSD jails for being poorly designed and therefore insecure.
The opening paragraph reads:
If you’re thinking of ...
3
votes
2answers
270 views
What lightweight sandboxing options do I have on linux?
What can I use to avoid running a full-fledged VM that gives me comparable security?
Possibly, something like https://coreos.com/rkt/ but I don't know what their security properties are.
2
votes
1answer
872 views
LXC vs. LXD: Which is “more secure”?
My friend told me today that I should never use LXC without changing its default configuration. Instead, I should prefer to use LXD, as it is "more secure" by default.
Is that true? What are the ...
