Questions tagged [docker]
The docker tag has no usage guidance.
103
questions
0
votes
1answer
103 views
Can network traffic between Docker containers be sniffed?
On normal networks, it is a security risk to send plaintext data, since attackers can sniff or even manipulate all traffic. Encryption is required for secure communication. When using Docker ...
1
vote
0answers
62 views
Is it safe to run a Kubernetes container as a root user? [closed]
I run my Spring Boot (Java) application in the Kubernetes environment as a root user and with JMX authentication turned on.
My k8s containers are being flagged as a security risk by the security ...
0
votes
0answers
31 views
Exploitation differences between Docker and VirtualBox for CVE-2010-4221
I am currently working on a research project where I analyze exploits in different virtualized environments. As an example I picked ProFTPd v1.3.3c which has a remote code execution vulnerability.
I ...
3
votes
1answer
67 views
Secure elasticsearch in Docker [closed]
How can I secure elasticsearch for production use in Docker?
I use this docker-compose.yml:
version: '2'
services:
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:5.6.16
...
0
votes
0answers
20 views
Degraded security of identical TLS keypairs when orchestrating containers?
In an orchestrated container environment such as Kubernetes, is it meaningful to have TLS-enabled connections from the load-balancer (LB) to the pods if you plan to auto-scale horizontally?
...
0
votes
0answers
11 views
Dockerfile - What user should be the owner for a mount point?
In the docker-compose file, below is the volumes instruction for builder service:
builder:
build: ../../
dockerfile: docker/dev/Dockerfile
volumes:
- ../../target:/wheelhouse
volumes_from:...
2
votes
0answers
63 views
How to securely run Puppeteer / Chromium in a Docker container?
Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing.
The problem is that, from ...
0
votes
1answer
47 views
Handling secrets and environmental variables in Docker-k8s-skaffold dev environment
Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it.
Just ...
3
votes
1answer
97 views
How to execute a command directly on the host system through docker.sock in a Docker container? [closed]
I've been studying Docker security and examining ways of escaping from container to host.
Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
1
vote
1answer
62 views
Securing Code Secrets - What is the relevance if the host gets compromised?
I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
3
votes
0answers
307 views
Disable ASLR inside Docker container
I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a ...
3
votes
0answers
167 views
What are the security implications of capabilities in Kubernetes pods?
We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities:
...
0
votes
2answers
132 views
Docker container which reads memory belonging to another container
The field of maliciously accessing another process's memory has been broadly studied in the Linux environment.
But for some reason I am not able to find similar discussion/similarities for the ...
2
votes
1answer
1k views
What are the risks of exposing the Docker for Windows daemon on localhost?
A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab.
There is a warning:
Exposing daemon on TCP ...
1
vote
1answer
188 views
How to harden container hosts?
https://github.com/docker/docker-bench-security
git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security
docker build --no-cache -t docker-bench-security .
docker run -...
0
votes
0answers
55 views
Is it possible to use wolfTPM SDK to talk to a TPM 2.0 chip from within a docker container?
Is it possible to use wolfTPM SDK to talk to a TPM 2.0 chip from within a Docker container?
2
votes
1answer
719 views
CIS hardening of alpine based docker container
I've got a service running inside a docker container. I've built my own image based on nginx:stable-alpine docker image.
I am trying to ascertain whether the concept of CIS hardening applies to the ...
2
votes
0answers
708 views
Use self-signed certificate inside of Docker Container for localhost
I've created a self-signed certificate for localhost to use https.
I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
0
votes
2answers
141 views
Securely compile foreign code and run it on a server?
I would like to set up a server that can receive source code directly, compile/interpret it and execute it.
The code could be C#, Java, C++, C, Javascript, PHP...
There will obviously be security ...
7
votes
1answer
626 views
Security risks of using ffmpeg as part of web service
I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
1
vote
0answers
230 views
Lets Encrypt + Cert Bot: Setting up known Certificate Authority
I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only.
I had ...
2
votes
1answer
133 views
Containerization vs. Chroot in shared hosting
Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
6
votes
2answers
2k views
Docker: when to use apparmor vs seccomp vs --cap-drop
Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container.
However I couldn't find any documentation or guideline on when to use which ...
1
vote
1answer
110 views
Security (IP discovering) on Kubernetes
I'm trying to improve my security knowledge on containers environments.
Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
0
votes
1answer
400 views
watch DNS queries while using OpenVPN.-
I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client.
My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
2
votes
0answers
219 views
What's the risk from enabling ptrace in docker?
Solutions for various problems (e.g., here and here) suggest enabling SYS_PTRACE when running a container that, say, needs to run a debugger or a fuzzer. Given that the capability isn't enabled by ...
1
vote
1answer
46 views
What is needed to secure a docker container that's running on nodes in an AWS Private Subnet with internet access only via NAT?
I know securing a container is a big deal and a lot is needed to be done to secure a default container configuration. But having it in a private subnet should take care of a lots of risks.
So what ...
6
votes
2answers
2k views
Where to find the security hardened docker images
Is there any service that provides certified, security hardened Docker images for common platforms like Python, PHP, Node, Java, etc. with 0 major/critical CVEs.
Currently, we are using the ones from ...
3
votes
1answer
899 views
Running Docker container as Root user
Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear:
Is it still the same kind of insecure even if the container cannot ...
2
votes
2answers
83 views
Can sharing docker info compromise security?
Running docker info gives a result such as this:
$ docker info
Containers: 1
Running: 0
Paused: 0
Stopped: 1
Images: 2
Server Version: 18.06.1-ce
Storage Driver: overlay2
Backing Filesystem: ...
1
vote
2answers
173 views
Add main user account to docker group
I recently installed ubuntu on my home system. As I am going to mainly use it for machine learning research, I tried to set up a python environment. I tried doing this with docker to make things ...
0
votes
1answer
98 views
What would be reasonable approach for sandboxing new project to be protected against security holes made by chance?
As a regular developer I'm curious about looking at new projects. Let's say today I want to contribute to open source project in Python. This project is on GitHub and I a kind of confident in people ...
0
votes
1answer
2k views
Docker + AV on the host
I've dug through some history of this site (which inevitably means someone will post how I missed it) and didn't find anything directly relating to my question.
What has been the typical solution ...
4
votes
3answers
653 views
Managing trusted certificates revocation in containers in as “cloud native” means as possible
This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can.
Problem statement
I'm looking for a modern best practice for managing and deploying the trusted root CA ...
0
votes
3answers
306 views
Is it risky to mount tmpfs volumes in Docker?
Sometimes I need to run I/O intensive operations in memory. The tmpfs facility works really well for this, but I was wondering if there are any big risks of using tmpfs mounts inside a container. Can ...
4
votes
2answers
469 views
How to prevent a docker container from being attached by multiple users?
When you run docker containers you can list running containers by using docker ps
Then you can attach them by docker attach <container id>
The trouble is that all people that can attach the ...
0
votes
1answer
178 views
Is it normal to being able to kill a process from outside a container?
Situation: on user@host a qemu run and stack inside a container user@container
Is it normal:
to view with ps aux | grep qemu from user@host that the process run on user@container?
to be able to ...
1
vote
0answers
66 views
Securely retrieving and exposing configuration within Docker
It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
2
votes
2answers
478 views
Should the traffic between the containers need to be encrypted?
Should the traffic between two containers in same docker environment need to be encrypted ?
Is it possible for a container to snoop into the un-encrypted traffic between two containers ?
1
vote
1answer
510 views
osquery in Docker environment
I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security ...
0
votes
1answer
35 views
Do I need to trust my Paas provider?
I am currently entering the world of deploying my web application to the cloud.
While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The ...
5
votes
5answers
1k views
Should I remove bash from my Docker web app container?
Suppose I am a dev and want to harden my web application environment. If my application does not make use of binaries like sh, ls, find, echo etc. should I just remove them from my image?
1
vote
0answers
73 views
I had a (password protected) postgres docker container running on a public port for a few minutes [closed]
Could the server be compromised? I've deleted the container.
3
votes
2answers
85 views
What approaches exist for ensuring security when deploying software in non-trusted environments?
Is it possible to deploy software in such a way that a rogue actor who has physical access to the hardware is unable to glean any information on the code that is running or what is being stored in ...
5
votes
1answer
326 views
How secure is LXD compared to Docker?
I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?
3
votes
1answer
3k views
Is adding docker group not a good idea?
Question
Is creating a docker group could be a bad idea from security perspectives?
I saw stack exchange answers which tells to create docker group to avoid issues of needing root permission or sudo....
1
vote
1answer
419 views
Option to secure docker socket from containers
Objective
Understand the options to secure the docker.sock.
Background
As in those articles, giving containers the access to docker.sock is a risk.
Don't expose the Docker socket (not even to a ...
2
votes
1answer
1k views
How to find an appropriate SELinux type to prevent “permission denied”
Objective
Find out a solution to avoid the permission denied due to SELinux.
Background
Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
5
votes
2answers
241 views
How to build arbitrary Dockerfile Images Without Compromising Host
I'm building a server that will build images directly from Dockerfile:
docker build -t arbitrarydocker .
This docker file will be built on the same server as other client Dockerfiles, which may have ...
48
votes
1answer
9k views
How to mitigate Meltdown in Docker images?
On https://meltdownattack.com/ it is suggested that (in some cases?) scenarios with Docker containers are also vulnerable.
I'm a developer using Docker for two different purposes:
Images used for ...
