Questions tagged [container]
The container tag has no usage guidance.
27
questions
0
votes
0answers
45 views
What is / are the best threat modeling method(s) for container security?
I am currently researching threat modeling for container security, I am wondering which methods are the best for container security. Till now I got the conclusion that STRIDE is most used and it is ...
2
votes
1answer
103 views
Secure Communication between Swarm Worker Nodes
I have a Swarm Cluster and want to communicate securely between Windows Worker Nodes. The official Docker Documentation (https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/) states:
The ...
0
votes
0answers
28 views
Find which image has CVE package fixes
I have a handful of google container images that are flagging musl vulns.
Example:
gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.13
https://console.cloud.google.com/gcr/images/google-...
2
votes
1answer
240 views
What are the best practices for anti-virus / anti-malware when using containers?
One of the SOC 2 controls is apparently around ensuring antivirus/anti-spam/anti-malware is running on production servers. I've been googling to see if there are any recommendation/best practices for ...
0
votes
0answers
46 views
Is it OK to use HTTP for internal communication between two micro-services deployed on AWS ECS fargate?
I have micro services deployed as AWS ECS Fargate containers. For internal communication they are using service discovery end point.
In my opinion, it is OK to use HTTP for internal communication. ...
6
votes
1answer
468 views
How to execute a command directly on the host system through docker.sock in a Docker container?
I've been studying Docker security and examining ways of escaping from container to host.
Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
2
votes
0answers
456 views
How safe is it to enable unprivileged user namespace: unprivileged_userns_clone [duplicate]
Linux user namespaces are special, as they play the role of the owner of the other namespaces.
Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled.
For ...
1
vote
1answer
158 views
Virtualized or Container (Remote) Based Browser Isolation is more secure?
There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.
1
vote
2answers
113 views
Secure browsing on any device without limiting the browser
The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation.
Employees depend ...
0
votes
1answer
483 views
Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
Specially, can an attacker escape ...
53
votes
2answers
9k views
If a container is compromised does that mean host also compromised?
Recently, I have heard of a new virtualization tech called containers. Suppose the container has been compromised, does this mean the host is also compromised (since the container is a process on a ...
2
votes
1answer
193 views
Containerization vs. Chroot in shared hosting
Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
1
vote
1answer
113 views
Security (IP discovering) on Kubernetes
I'm trying to improve my security knowledge on containers environments.
Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
3
votes
1answer
989 views
Running Docker container as Root user
Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear:
Is it still the same kind of insecure even if the container cannot ...
4
votes
3answers
839 views
Managing trusted certificates revocation in containers in as “cloud native” means as possible
This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can.
Problem statement
I'm looking for a modern best practice for managing and deploying the trusted root CA ...
4
votes
2answers
580 views
How to prevent a docker container from being attached by multiple users?
When you run docker containers you can list running containers by using docker ps
Then you can attach them by docker attach <container id>
The trouble is that all people that can attach the ...
0
votes
1answer
201 views
Is it normal to being able to kill a process from outside a container?
Situation: on user@host a qemu run and stack inside a container user@container
Is it normal:
to view with ps aux | grep qemu from user@host that the process run on user@container?
to be able to ...
5
votes
1answer
361 views
How secure is LXD compared to Docker?
I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?
1
vote
1answer
494 views
Option to secure docker socket from containers
Objective
Understand the options to secure the docker.sock.
Background
As in those articles, giving containers the access to docker.sock is a risk.
Don't expose the Docker socket (not even to a ...
9
votes
1answer
12k views
Docker runs container processes as root - should I be worried?
I am running a (QNAP) NAS with Docker functionality ("containerstation"). I thought it would be a lot safer to install apps via containers instead of apps from the store (or 3rd party stores).
Many ...
0
votes
2answers
435 views
Docker secret security
I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my ...
1
vote
1answer
427 views
Potential added risks of using Docker in production servers
What are the added security risks of using a dockerized container to deploy a production server?
Not interested in risks that would exist anyway in deploying a production server the traditional way,...
0
votes
1answer
203 views
Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?
I want to encrypt a large blob of binary data (let's say, 1GB), using asymmetric encryption (so that only public key is needed to encrypt the data, but private key is needed to decrypt it). As a nice ...
33
votes
2answers
32k views
Is it possible to escalate privileges and escaping from a Docker container?
I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc.
I saw how easy is to get root in a docker host machine once you entered to the ...
1
vote
0answers
996 views
Are BSD jails a “huge security liability”? [closed]
In this 2014 blog post from an apparently anti-BSD blog, the author criticizes BSD jails for being poorly designed and therefore insecure.
The opening paragraph reads:
If you’re thinking of ...
3
votes
2answers
323 views
What lightweight sandboxing options do I have on linux?
What can I use to avoid running a full-fledged VM that gives me comparable security?
Possibly, something like https://coreos.com/rkt/ but I don't know what their security properties are.
2
votes
1answer
996 views
LXC vs. LXD: Which is “more secure”?
My friend told me today that I should never use LXC without changing its default configuration. Instead, I should prefer to use LXD, as it is "more secure" by default.
Is that true? What are the ...
