Questions tagged [container]
The container tag has no usage guidance.
46
questions
0
votes
0answers
14 views
Tools for "scanning" container (hardening) vulnerabilities vs tools for "performing" the hardening [closed]
CIS has published a list of container vulnerabilities that should be addressed to complete the hardening process.
Are there separate sets of tools that only point out the vulnerabilities
and then ...
0
votes
1answer
48 views
Certificates generated by internal CA show Verification error: self signed certificate and other errors when using curl against URL
I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-...
0
votes
0answers
28 views
Is the Docker cache a security risk due to stale base images?
I always thought that when I build the Dockerfile for my application, the latest version of the base image is downloaded from the registry (and in this way I have a fresh version with all the security ...
0
votes
1answer
137 views
Why Vulnerability Scanners Ignore Shared Libraries?
First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
0
votes
0answers
53 views
How to protect workload from host [duplicate]
I have some code and other resources which run in a container or VM ("black box") on a host machine. The host uses this as a service to process some files which are highly sensitive and ...
1
vote
2answers
79 views
Logging docker container logins, EC2 Host
I have an AWS EC2 instance with docker installed, running a default nginx container - docker run -it --rm -d -p 8080:80 --name web nginx.
I have an rsyslog setup that successfully captures the auth....
2
votes
0answers
49 views
Are there any security advantages to using Kernel Keyring versus the default file based caches for Kerberos on Linux? [closed]
In a containerized environment, what would be the most appropriate way of configuring Kerberos caches?
6
votes
0answers
215 views
Are Ubuntu Snaps more secure than the classic installation method from the official repos?
Today Ubuntu (and some other distros) offer a new way to install software, which is snaps. It's software packaged with all its dependencies, run with some kind of containerization, and auto-updated. ...
0
votes
0answers
17 views
How to secure container to prevent sensitive information leak? [duplicate]
So I have to deploy a container containing the backend into the clients network, (they have policies about data not leaving premise). But how do i secure my container to prevent the client from ...
1
vote
1answer
67 views
Do I need to keep production Docker/container images?
Context
My company is developing a SaaS solution that needs to conform to PCI-DSS L1 for sure, and possibly FedRAMP and other frameworks later.
We can do continuous deployment with feature flagged/...
1
vote
2answers
95 views
Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?
Can a meltdown attack also violate data integrity of other processes by obtaining different passwords or is it just violating data secrecy by reading data it is unauthorized to do?
0
votes
0answers
31 views
secure deletion in virtual machines [duplicate]
when we securely delete a volume in a machine which is installed in a virtual machine or docker, for example by overwriting 7 times or more, we securely delete the data in virtual disk (in guest) and ...
2
votes
1answer
99 views
Container Vulnerability Management
Having difficulty understanding how to translate 'traditional' vulnerability management to a cloud environment. Previously accustomed to using tools like OpenVAS and Nessus, setting up scans which ...
1
vote
0answers
52 views
Linuxcontainers » LXC : Security Vulnerabilities
I have a question regarding Linuxcontainers. How do you classify the security vulnerability mentioned here, more specifically the ones that ends with 6441,1331,1134,1335 and 10124.
I mean are they a ...
0
votes
2answers
378 views
Requesting an SSL certificate without a CSR, can it be done?
Please excuse me if this is a dumb or obvious question, I'm self taught and have not been able to find an exact answer to my question after much Googling and reading through StacEx!
I'm having issues ...
1
vote
0answers
42 views
Running non-root process in docker vs bare metal
Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container.
Reasoning behind that is that ...
0
votes
1answer
144 views
Hiding text string with steganographic method - practical problem
I'd like to ask for small hint with following problem:
Using the steganographic method of the least significant bits, hide
the text string "Kra" in four pixels of color with RGB code
. Hide ...
1
vote
1answer
64 views
Build and execute code on a sandboxed environment?
Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
1
vote
1answer
256 views
What disadvantages running untrusted applications in anbox has over running them in a virtual machine?
I consider running Android applications in Anbox instead of running them in a virtual machine (Android-x86 in GNOME Boxes using QEMU with KVM). Does it increase the chances that malicious code in an ...
0
votes
1answer
424 views
Can malicious applications running inside a docker container still be harmful? [duplicate]
I am very new to docker (and don't usually program at a 'systems' level). I will be working on an open source project with complete strangers over the web over the next couple of months. I trust them, ...
2
votes
1answer
401 views
Podman: What if user is member of docker group?
From a security perspective: Is it necessary that a user, that runs OCI containers with Podman, is not at the same time a member of the docker group?
From what I understand the idea behind Podman is ...
2
votes
1answer
100 views
Is uncompromisable obfuscated x86-64 execution possible?
I have a problem which has several layers;
Provide a distributed computing plane where actors can voluntarily add and remove computing resources from, the actors are untrusted by default, and thus ...
3
votes
1answer
375 views
Secure Communication between Swarm Worker Nodes
I have a Swarm Cluster and want to communicate securely between Windows Worker Nodes. The official Docker Documentation (https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/) states:
The ...
3
votes
1answer
2k views
What are the best practices for anti-virus / anti-malware when using containers?
One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
8
votes
1answer
7k views
How to execute a command directly on the host system through docker.sock in a Docker container?
I've been studying Docker security and examining ways of escaping from container to host.
Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
3
votes
0answers
1k views
How safe is it to enable unprivileged user namespace: unprivileged_userns_clone [duplicate]
Linux user namespaces are special, as they play the role of the owner of the other namespaces.
Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled.
For ...
1
vote
1answer
292 views
Virtualized or Container (Remote) Based Browser Isolation is more secure?
There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.
1
vote
2answers
136 views
Secure browsing on any device without limiting the browser
The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation.
Employees depend ...
0
votes
1answer
802 views
Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
Specially, can an attacker escape ...
55
votes
2answers
9k views
If a container is compromised does that mean host also compromised?
Recently, I have heard of a new virtualization tech called containers. Suppose the container has been compromised, does this mean the host is also compromised (since the container is a process on a ...
2
votes
1answer
452 views
Containerization vs. Chroot in shared hosting
Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
1
vote
1answer
148 views
Security (IP discovering) on Kubernetes
I'm trying to improve my security knowledge on containers environments.
Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
3
votes
1answer
1k views
Running Docker container as Root user
Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear:
Is it still the same kind of insecure even if the container cannot ...
5
votes
3answers
1k views
Managing trusted certificates revocation in containers in as "cloud native" means as possible
This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can.
Problem statement
I'm looking for a modern best practice for managing and deploying the trusted root CA ...
4
votes
2answers
966 views
How to prevent a docker container from being attached by multiple users?
When you run docker containers you can list running containers by using docker ps
Then you can attach them by docker attach <container id>
The trouble is that all people that can attach the ...
0
votes
1answer
303 views
Is it normal to being able to kill a process from outside a container?
Situation: on user@host a qemu run and stack inside a container user@container
Is it normal:
to view with ps aux | grep qemu from user@host that the process run on user@container?
to be able to ...
5
votes
1answer
500 views
How secure is LXD compared to Docker?
I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?
1
vote
1answer
630 views
Option to secure docker socket from containers
Objective
Understand the options to secure the docker.sock.
Background
As in those articles, giving containers the access to docker.sock is a risk.
Don't expose the Docker socket (not even to a ...
10
votes
1answer
14k views
Docker runs container processes as root - should I be worried?
I am running a (QNAP) NAS with Docker functionality ("containerstation"). I thought it would be a lot safer to install apps via containers instead of apps from the store (or 3rd party stores).
Many ...
1
vote
4answers
501 views
Docker secret security
I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my ...
1
vote
1answer
442 views
Potential added risks of using Docker in production servers
What are the added security risks of using a dockerized container to deploy a production server?
Not interested in risks that would exist anyway in deploying a production server the traditional way,...
0
votes
1answer
250 views
Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?
I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice ...
38
votes
2answers
37k views
Is it possible to escalate privileges and escaping from a Docker container?
I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc.
I saw how easy is to get root in a docker host machine once you entered to the ...
1
vote
0answers
1k views
Are BSD jails a "huge security liability"? [closed]
In this 2014 blog post from an apparently anti-BSD blog, the author criticizes BSD jails for being poorly designed and therefore insecure.
The opening paragraph reads:
If you’re thinking of ...
3
votes
2answers
513 views
What lightweight sandboxing options do I have on linux?
What can I use to avoid running a full-fledged VM that gives me comparable security?
Possibly, something like https://coreos.com/rkt/ but I don't know what their security properties are.
2
votes
1answer
1k views
LXC vs. LXD: Which is “more secure”?
My friend told me today that I should never use LXC without changing its default configuration. Instead, I should prefer to use LXD, as it is "more secure" by default.
Is that true? What are the ...
