Questions tagged [container]

The tag has no usage guidance.

0
votes
0answers
58 views

How safe is it to enable unprivileged user namespace: unprivileged_userns_clone

Linux user namespaces are special, as they play the role of the owner of the other namespaces. Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled. For ...
0
votes
1answer
52 views

Virtualized or Container (Remote) Based Browser Isolation is more secure?

There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.
1
vote
2answers
82 views

Secure browsing on any device without limiting the browser

The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation. Employees depend ...
0
votes
1answer
148 views

Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails? Specially, can an attacker escape ...
53
votes
2answers
8k views

If a container is compromised does that mean host also compromised?

Recently, I have heard of a new virtualization tech called containers. Suppose the container has been compromised, does this mean the host is also compromised (since the container is a process on a ...
2
votes
1answer
91 views

Containerization vs. Chroot in shared hosting

Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
1
vote
1answer
103 views

Security (IP discovering) on Kubernetes

I'm trying to improve my security knowledge on containers environments. Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
2
votes
1answer
620 views

Running Docker container as Root user

Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear: Is it still the same kind of insecure even if the container cannot ...
2
votes
3answers
488 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
4
votes
2answers
405 views

How to prevent a docker container from being attached by multiple users?

When you run docker containers you can list running containers by using docker ps Then you can attach them by docker attach <container id> The trouble is that all people that can attach the ...
0
votes
1answer
140 views

Is it normal to being able to kill a process from outside a container?

Situation: on user@host a qemu run and stack inside a container user@container Is it normal: to view with ps aux | grep qemu from user@host that the process run on user@container? to be able to ...
5
votes
1answer
256 views

How secure is LXD compared to Docker?

I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?
1
vote
1answer
362 views

Option to secure docker socket from containers

Objective Understand the options to secure the docker.sock. Background As in those articles, giving containers the access to docker.sock is a risk. Don't expose the Docker socket (not even to a ...
8
votes
1answer
9k views

Docker runs container processes as root - should I be worried?

I am running a (QNAP) NAS with Docker functionality ("containerstation"). I thought it would be a lot safer to install apps via containers instead of apps from the store (or 3rd party stores). Many ...
0
votes
2answers
370 views

Docker secret security

I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my ...
0
votes
1answer
396 views

Potential added risks of using Docker in production servers

What are the added security risks of using a dockerized container to deploy a production server? Not interested in risks that would exist anyway in deploying a production server the traditional way,...
0
votes
1answer
175 views

Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?

I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice ...
28
votes
2answers
25k views

Is it possible to escalate privileges and escaping from a Docker container?

I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc. I saw how easy is to get root in a docker host machine once you entered to the ...
1
vote
0answers
801 views

Are BSD jails a “huge security liability”? [closed]

In this 2014 blog post from an apparently anti-BSD blog, the author criticizes BSD jails for being poorly designed and therefore insecure. The opening paragraph reads: If you’re thinking of ...
3
votes
2answers
276 views

What lightweight sandboxing options do I have on linux?

What can I use to avoid running a full-fledged VM that gives me comparable security? Possibly, something like https://coreos.com/rkt/ but I don't know what their security properties are.
2
votes
1answer
920 views

LXC vs. LXD: Which is “more secure”?

My friend told me today that I should never use LXC without changing its default configuration. Instead, I should prefer to use LXD, as it is "more secure" by default. Is that true? What are the ...