Questions tagged [container]
The container tag has no usage guidance.
21
questions
2
votes
0answers
156 views
How safe is it to enable unprivileged user namespace: unprivileged_userns_clone [duplicate]
Linux user namespaces are special, as they play the role of the owner of the other namespaces.
Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled.
For ...
0
votes
1answer
78 views
Virtualized or Container (Remote) Based Browser Isolation is more secure?
There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.
1
vote
2answers
94 views
Secure browsing on any device without limiting the browser
The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation.
Employees depend ...
0
votes
1answer
267 views
Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
Specially, can an attacker escape ...
53
votes
2answers
8k views
If a container is compromised does that mean host also compromised?
Recently, I have heard of a new virtualization tech called containers. Suppose the container has been compromised, does this mean the host is also compromised (since the container is a process on a ...
2
votes
1answer
109 views
Containerization vs. Chroot in shared hosting
Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
1
vote
1answer
108 views
Security (IP discovering) on Kubernetes
I'm trying to improve my security knowledge on containers environments.
Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
3
votes
1answer
839 views
Running Docker container as Root user
Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear:
Is it still the same kind of insecure even if the container cannot ...
3
votes
3answers
581 views
Managing trusted certificates revocation in containers in as “cloud native” means as possible
This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can.
Problem statement
I'm looking for a modern best practice for managing and deploying the trusted root CA ...
4
votes
2answers
441 views
How to prevent a docker container from being attached by multiple users?
When you run docker containers you can list running containers by using docker ps
Then you can attach them by docker attach <container id>
The trouble is that all people that can attach the ...
0
votes
1answer
165 views
Is it normal to being able to kill a process from outside a container?
Situation: on user@host a qemu run and stack inside a container user@container
Is it normal:
to view with ps aux | grep qemu from user@host that the process run on user@container?
to be able to ...
5
votes
1answer
292 views
How secure is LXD compared to Docker?
I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?
1
vote
1answer
398 views
Option to secure docker socket from containers
Objective
Understand the options to secure the docker.sock.
Background
As in those articles, giving containers the access to docker.sock is a risk.
Don't expose the Docker socket (not even to a ...
8
votes
1answer
10k views
Docker runs container processes as root - should I be worried?
I am running a (QNAP) NAS with Docker functionality ("containerstation"). I thought it would be a lot safer to install apps via containers instead of apps from the store (or 3rd party stores).
Many ...
0
votes
2answers
400 views
Docker secret security
I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my ...
0
votes
1answer
396 views
Potential added risks of using Docker in production servers
What are the added security risks of using a dockerized container to deploy a production server?
Not interested in risks that would exist anyway in deploying a production server the traditional way,...
0
votes
1answer
180 views
Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?
I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice ...
29
votes
2answers
27k views
Is it possible to escalate privileges and escaping from a Docker container?
I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc.
I saw how easy is to get root in a docker host machine once you entered to the ...
1
vote
0answers
851 views
Are BSD jails a “huge security liability”? [closed]
In this 2014 blog post from an apparently anti-BSD blog, the author criticizes BSD jails for being poorly designed and therefore insecure.
The opening paragraph reads:
If you’re thinking of ...
3
votes
2answers
281 views
What lightweight sandboxing options do I have on linux?
What can I use to avoid running a full-fledged VM that gives me comparable security?
Possibly, something like https://coreos.com/rkt/ but I don't know what their security properties are.
2
votes
1answer
952 views
LXC vs. LXD: Which is “more secure”?
My friend told me today that I should never use LXC without changing its default configuration. Instead, I should prefer to use LXD, as it is "more secure" by default.
Is that true? What are the ...
