Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [docker]

Docker is a popular virtualization solution that provides virtualization within an operating system for reusable packages of software called containers. More information available at docker.com.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
90 views

How to use `docker secret` to prevent secrets from being seen in plain text by unauthorized individuals

I am exploring how to use docker secrets, but all the secrets are visible in plain text format to anyone who can use the docker command. How do I ensure all secrets are sufficiently protected and not ...
learningtech's user avatar
0 votes
0 answers
76 views

Connecting Logstash To Elasticsearch via SSL (Docker Container)

My environment consists of 2 docker containers, one running Logstash and another running Elasticsearch on the SAME host & SAME docker network. I am trying to setup SSL between the 2 of them (this ...
Dhiwakar Ravikumar's user avatar
0 votes
0 answers
102 views

I do not understand how the standard practice to pass secrets as environment variables to containers considered as safe? [duplicate]

TL;DR The container's environment variable can be queried many ways, with native docker tools or 3rd party tools. The docker admin user (or any user in the docker group) not necessary dba on a ...
g.pickardou's user avatar
0 votes
1 answer
122 views

Safe or not? Elasticsearch on localhost through Docker

I am learning to run Elasticsearch in a Docker container on a laptop. For a start, I expect running it on localhost. The laptop is connected to the Internet. Is that unsafe? I remember that ipython/...
Johan's user avatar
  • 103
0 votes
1 answer
81 views

Why is ip forwarding for a ECS instance being flagged as a vulnerability?

I am very new to this and was asked to address some security patches on various ec2 instances in our AWS account. Mostly this was a matter of using the Security Manager to connect to the instance and ...
Rob D's user avatar
  • 1
1 vote
1 answer
178 views

Network security in Docker containers

I am currently involved in enhancing the security of a Docker-based web application.The application follows a traditional three-tier architecture, comprising a web app, an application layer, and a ...
apostolescus's user avatar
1 vote
0 answers
244 views

Is a docker container that requires "clone" and "unshare" syscalls of any use?

I am not very skilled at linux and besides reading about clone and unshare I would love to have some second opinion on the situation: The setup A process I intend to run is an automated "chrome ...
Samuel's user avatar
  • 728
2 votes
2 answers
229 views

Debian's security tracker says a CVE is fixed, while BlackDuck scanner detects it

I stumbled across a vulnerability considered a critical security risk (CVE-2023-25139) in one of container images I build. Debian's security tracker states it's fixed: https://security-tracker.debian....
Roman Grazhdan's user avatar
0 votes
2 answers
916 views

docker daemon reports 'tls: unconfigured cipher suite' for Nginx reverse proxy of Artifactory Docker registry

I am migrating to Artifactory on RHEL8 as a Docker remote repository, i.e. Artifactory is a proxy for a docker registry hosted through Jfrog.io. We have a legacy registry with config in /etc/docker/...
bbaassssiiee's user avatar
0 votes
1 answer
258 views

The safest and fastest way to upload files in Docker Container

In a docker project of Asp.net Core MVC 6.0, users must upload files to wwwroot of the project but nothing checks to see if the file is safe or not. I check file extensions with my file header library ...
mamad2559's user avatar
  • 103
0 votes
0 answers
92 views

2 network tunnels from 2 providers to 1 machine running docker, will this expose all containers on both tunnels?

I have a server running multiple docker containers, accessible through tunneling. I want to create a new tunnel that is separate from the one I already have. Will the new tunnel service interfere or ...
Maize's user avatar
  • 1
0 votes
1 answer
98 views

Is deploying a web application to a customer's encrypted drive a secure solution against code theft?

I have developed a web service for customer. The web service is written in Python and running in Docker containers. It is managed by docker compose. The customer wants my web service to run on their ...
harry_tums's user avatar
5 votes
2 answers
203 views

Can OpenSSL vulnerabilities be mitigated by Load Balancer service from Cloud Providers

We have a service running as a container for which there some reported vulnerabilities in OpenSSL. Our service is behind the Application Load Balancer, which ideally should terminate the traffic at ...
Brogrammer's user avatar
1 vote
1 answer
768 views

Can kubernetes pods in the same or different namespace sniff the packets of other pods?

Since the pods share the same subnet, is it possible that one pod can sniff the network packets of other pods? Please explain the reason. Note: I created 3 pods in the same namespace, on one pod I ran ...
warrior-oo7's user avatar
2 votes
1 answer
406 views

Risks from usage of CHROOT inside a Docker container

Can --cap-add SYS_CHROOT on a docker container be questioned as a potential security risk, and why? I'm seeking references and information from security professionals about using the chroot tool (and ...
Matteo T.'s user avatar
  • 121
0 votes
1 answer
109 views

Is it safe to run `docker load` on a potentially malicious archive generated by `docker save` which will later be run with the gvisor runtime?

The image loaded with docker load will be user submitted, and I may also add additional files to it (which could also be potentially malicious). A container will then be created based on the image, ...
Sreram's user avatar
  • 125
3 votes
1 answer
602 views

How do I prevent user from accessing docker image content?

I have a SaaS web application. One of my clients needs the app to be installed on his infrastructure (meaning physically on servers only they can access). The application stack is 2 docker images: one ...
Moen's user avatar
  • 31
0 votes
0 answers
497 views

Reverse proxy server in DMZ with separate server for nginx (docker)

Does it makes sense to create two separate docker hosts (VMs) for reverse-proxy and web application? My first idea was to put the web-exposed application in my separated VLAN (DMZ) where only ports 80 ...
ZeroW's user avatar
  • 1
1 vote
1 answer
201 views

"PUT /SDK/webLanguage HTTP/1.1" on a server with only port 22 open

I've recently spun on a new droplet on Digital Ocean with Ubuntu 22 and enabled UFW and allowed only SSH, which reports being active even after a reboot: sudo ufw status Status: active To ...
Fanu's user avatar
  • 13
3 votes
0 answers
977 views

Weird hack attempt nginx proxy manager and photoprism drives me nuts

I have a logged http request in nginx logs which drives me nuts because I don't understand how it's finding its way into the logs: [03/Jul/2023:13:45:04 +0000] 400 - GET http localhost "/bin/...
MuchToKnow's user avatar
0 votes
2 answers
1k views

Does a docker socket proxy improve security?

It's dangerous to expose the docker socket to a container, as malicious code could break out into the host. There are various ways to avoid this; a simple/popular approach is to use a proxy between ...
lonix's user avatar
  • 445
6 votes
1 answer
807 views

Does it matter if my docker container image is rootless, if docker daemon is rootless (or uses UserNS-remap)?

You can and generally should (1) run docker daemon (or podman, or something else) as rootless, and/or (2) use user namespace-remapping, to improve security. You can also (3) use rootless images, where ...
Janne Mattila's user avatar
-1 votes
2 answers
509 views

Strategy for storing private keys used in an embedded device

I am developing an embedded device using a bootloader. This means that the device will store in its flash an encryption key for decrypting update packages and an ECC public key for verifying update ...
user2563661's user avatar
2 votes
2 answers
116 views

Container Vulnerability Management for non-dev-organizations

Is there a good best practice for container vulnerability management when you are not a dev shop? I am currently trying to figure out how to set up a proper supply chain risk management system for a ...
Stefan Lorenz's user avatar
0 votes
1 answer
173 views

Are verified publisher docker containers safe?

I need to create a virtual machine that it stays up and running on my Synology NAS and it has to use a web browser where I need to insert some credentials. I saw a downloadable firefox container ( ...
al404IT's user avatar
  • 155
1 vote
0 answers
772 views

Reverse shell not working [closed]

I'm running a DVWA container on my kali VM using: docker run --rm -it -p 80:80 vulnerables/web-dvwa Network interface details: Kali docker0 int: 172.17.0.1/16 Kali eth0 int: 192.168.1.233/24 DVWA ...
registry4059's user avatar
0 votes
2 answers
225 views

Can I run safely remotely downloaded docker images

I often pull and run a docker images from hub.docker.com I am running with this command: docker run --it xxx/image /bin/bash I never share volumes (with -v option) for example. Let's suppose a ...
Bob5421's user avatar
  • 49
0 votes
3 answers
216 views

What is the most secure way to transfer untrusted data between containers?

Let's suppose we have two containers running on a linux box and one has untrusted user data that the other needs to process. What is the most secure way to transfer this data? Is it better to write ...
charles harris's user avatar
0 votes
0 answers
419 views

Why am I able to access EC2 metadata endpoint from within a Docker container running in the EC2

My understanding of containers is very basic and so is my understanding of AWS EC2. Recently while trying to debug a security issue, I came across a scenario where I was able to gain an RCE. Whether ...
qre0ct's user avatar
  • 1,522
1 vote
3 answers
118 views

Authenticating a request from a valid application (unshadowed)

I am working on an application which has an architectural description as below, There is a docker container, lets say Microservice-A, in which multiple processes are running. Each process is ...
HelloWorld's user avatar
2 votes
1 answer
170 views

Is it safe to use Python's secrets module in a fresh docker container?

If I create a new Docker container based on a recent Debian image, and if use this container to generate a cryptographic key using Python's secrets module, then is that key safe to use? My ...
MiniQuark's user avatar
  • 123
1 vote
2 answers
397 views

How do you share private keys for signing e.g. JWTs inside Docker-Containers?

I've written an application in NodeJS which essentially only performs a login: You send your username/password, and you retrieve an JWT (JSON Web Token). Those tokens are being signed by a private key....
Gandalf1783's user avatar
3 votes
1 answer
871 views

Docker Apache - safe to chown /usr/local/apache2 to non-root user?

I would like to run the official Docker Apache image as a non-root user. To make it work, it seems like it is necessary to chown the /usr/local/apache2 directory (see this and this): chown -hR appuser:...
Tando's user avatar
  • 163
0 votes
1 answer
123 views

ZipSlip directory traversal cannot reach root directory

I have discovered a ZipSlip vulnerability in a web application. Simply put, ZipSlip is basically a directory traversal through a specially crafted zip file, which is made to contain "../" ...
Giannis Pappas's user avatar
0 votes
2 answers
229 views

Does AWS security group block unintentionally exposed ports from Docker?

My typical cloud server hardening includes blocking ports at the UFW level on the server as well as at the AWS security group level. I recently learned that Docker overwrites your IPTables. Given that,...
angryserver's user avatar
2 votes
1 answer
509 views

Is better for security to not run Nginx and Backend inside docker but use docker only for database and not external exposed services?

I'm not a Docker specialist, I know how to install, configure and do only basic Docker hardening based on Docker official documentation. I know nothing about AppArmor,SELinux and GRSEC. But i need to ...
Awill Moto's user avatar
1 vote
1 answer
115 views

How do you control restrict actions within Docker without Kubernetes?

Based on the documentation here https://docs.docker.com/engine/security/, it does not seem that there are any built-in features to restrict the current logged-in user to run certain Docker commands. ...
transcend3nt's user avatar
1 vote
1 answer
622 views

What is the easiest way to find non-vulnerable container images?

I am fairly new to container image vulnerability scanning. There seem to be a lot of tools (Snyk, Trivvy, Clair, e.g.) that can identify vulnerable packages in container images. They also do a good ...
Scott McNeany's user avatar
1 vote
0 answers
292 views

Can a container with CAP_NET_ADMIN access the host namespace

I have a docker container that I run by adding the extra privilege of CAP_NET_ADMIN in addition to the default ones. If I don’t share the host net namespace with the container, the host namespace is ...
ayushman999's user avatar
0 votes
1 answer
284 views

Docker container can't access systemd service because of firewall

I'm in a somewhat weird situation that I don't understand: I use ufw as a firewall. It's setup to drop any input connections apart from ssh I have a service running locally (managed through systemd) ...
Rififi's user avatar
  • 157
0 votes
2 answers
264 views

Docker, running programs as Root and AWS

It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the ...
sdfgeoff's user avatar
  • 101
3 votes
1 answer
887 views

Why I am unable to execute insmod on the docker container?

I have started an unprivileged docker container and trying to start the privileged exec session. It has CAP_SYS_MODULE capabilities, but still, I am getting operations not permitted in insmod. docker ...
tbhaxor's user avatar
  • 133
7 votes
2 answers
2k views

/opt and sudo unzip to /opt, is it safe?

Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
Guerlando OCs's user avatar
2 votes
1 answer
149 views

Security of a ro volume in Docker

What are the security implications of mapping a host folder to a Docker container ro? For example -v /usr/local/bin:/usr/local/bin:ro. Of course, the container can now read the host folder. But, ...
SRobertJames's user avatar
1 vote
1 answer
264 views

How does gVisor run its own kernel replacement under Docker for security? [closed]

I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security. My question is: The whole point ...
SRobertJames's user avatar
3 votes
2 answers
756 views

Security of untrusted Docker containers

If I want to run untrusted code inside a Docker container, or an untrusted Docker container for that matter, how can I restrict it? I'd like to make sure it has no access to the host filesystem. ...
SRobertJames's user avatar
0 votes
0 answers
109 views

Security implications of using HTTP for service to service communication within the same host [duplicate]

What are the security implications of using HTTP only for IPC for services within the same host? In my case, I am using docker-compose to host two ASP.NET Core services within the same host in Azure. ...
Mariksel Azemaj's user avatar
1 vote
1 answer
440 views

Getting apparmor to profile a program inside docker container

I'm looking to profile a service running inside a specific docker container. I went through the documentation of aa-genprof and aa-autodep and both take program as input to profile. I can't seem to ...
TheKoolhatkar's user avatar
0 votes
0 answers
165 views

Docker: How to download & verify a publisher's root key (out-of-band, distinct-domain cryptographic verification, WoT)

For a given publisher of docker images on Docker Hub (let's say debian), how do I download their root release/image signing key and verify its authenticity from multiple sources out-of-band from each-...
Michael Altfield's user avatar
0 votes
1 answer
462 views

Why Vulnerability Scanners Ignore Shared Libraries?

First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
Artem A.'s user avatar

1
2 3 4 5