Questions tagged [docker]
The docker tag has no usage guidance.
0
votes
2answers
106 views
Docker container which reads memory belonging to another container
The field of maliciously accessing another process's memory has been broadly studied in the Linux environment.
But for some reason I am not able to find similar discussion/similarities for the ...
1
vote
1answer
207 views
What are the risks of exposing the Docker for Windows daemon on localhost?
A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab.
There is a warning:
Exposing daemon on TCP ...
1
vote
1answer
87 views
How to harden container hosts?
https://github.com/docker/docker-bench-security
git clone https://github.com/docker/docker-bench-security.git
cd docker-bench-security
docker build --no-cache -t docker-bench-security .
docker run -...
0
votes
0answers
36 views
Is it possible to use wolfTPM SDK to talk to a TPM 2.0 chip from within a docker container?
Is it possible to use wolfTPM SDK to talk to a TPM 2.0 chip from within a Docker container?
2
votes
1answer
320 views
CIS hardening of alpine based docker container
I've got a service running inside a docker container. I've built my own image based on nginx:stable-alpine docker image.
I am trying to ascertain whether the concept of CIS hardening applies to the ...
1
vote
0answers
484 views
Use self-signed certificate inside of Docker Container for localhost
I've created a self-signed certificate for localhost to use https.
I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
0
votes
2answers
115 views
Securely compile foreign code and run it on a server?
I would like to set up a server that can receive source code directly, compile/interpret it and execute it.
The code could be C#, Java, C++, C, Javascript, PHP...
There will obviously be security ...
7
votes
1answer
396 views
Security risks of using ffmpeg as part of web service
I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
1
vote
0answers
159 views
Lets Encrypt + Cert Bot: Setting up known Certificate Authority
I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only.
I had ...
2
votes
1answer
90 views
Containerization vs. Chroot in shared hosting
Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
3
votes
2answers
1k views
Docker: when to use apparmor vs seccomp vs --cap-drop
Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container.
However I couldn't find any documentation or guideline on when to use which ...
1
vote
1answer
103 views
Security (IP discovering) on Kubernetes
I'm trying to improve my security knowledge on containers environments.
Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
0
votes
1answer
243 views
watch DNS queries while using OpenVPN.-
I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client.
My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
2
votes
0answers
131 views
What's the risk from enabling ptrace in docker?
Solutions for various problems (e.g., here and here) suggest enabling SYS_PTRACE when running a container that, say, needs to run a debugger or a fuzzer. Given that the capability isn't enabled by ...
1
vote
1answer
38 views
What is needed to secure a docker container that's running on nodes in an AWS Private Subnet with internet access only via NAT?
I know securing a container is a big deal and a lot is needed to be done to secure a default container configuration. But having it in a private subnet should take care of a lots of risks.
So what ...
2
votes
2answers
890 views
Where to find the security hardened docker images
Is there any service that provides certified, security hardened Docker images for common platforms like Python, PHP, Node, Java, etc. with 0 major/critical CVEs.
Currently, we are using the ones from ...
2
votes
1answer
595 views
Running Docker container as Root user
Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear:
Is it still the same kind of insecure even if the container cannot ...
2
votes
2answers
78 views
Can sharing docker info compromise security?
Running docker info gives a result such as this:
$ docker info
Containers: 1
Running: 0
Paused: 0
Stopped: 1
Images: 2
Server Version: 18.06.1-ce
Storage Driver: overlay2
Backing Filesystem: ...
1
vote
2answers
107 views
Add main user account to docker group
I recently installed ubuntu on my home system. As I am going to mainly use it for machine learning research, I tried to set up a python environment. I tried doing this with docker to make things ...
0
votes
1answer
85 views
What would be reasonable approach for sandboxing new project to be protected against security holes made by chance?
As a regular developer I'm curious about looking at new projects. Let's say today I want to contribute to open source project in Python. This project is on GitHub and I a kind of confident in people ...
0
votes
1answer
1k views
Docker + AV on the host
I've dug through some history of this site (which inevitably means someone will post how I missed it) and didn't find anything directly relating to my question.
What has been the typical solution ...
2
votes
3answers
463 views
Managing trusted certificates revocation in containers in as “cloud native” means as possible
This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can.
Problem statement
I'm looking for a modern best practice for managing and deploying the trusted root CA ...
0
votes
3answers
264 views
Is it risky to mount tmpfs volumes in Docker?
Sometimes I need to run I/O intensive operations in memory. The tmpfs facility works really well for this, but I was wondering if there are any big risks of using tmpfs mounts inside a container. Can ...
0
votes
0answers
301 views
Docker Isolation Vs VM Isolation [duplicate]
I was watching Learn Docker in 12 Minutes and at 1:40 he said the isolation of Docker is a compromise and that it's not as strong as VM's but he doesn't mention why. I wonder what could be the reason. ...
4
votes
2answers
390 views
How to prevent a docker container from being attached by multiple users?
When you run docker containers you can list running containers by using docker ps
Then you can attach them by docker attach <container id>
The trouble is that all people that can attach the ...
0
votes
1answer
138 views
Is it normal to being able to kill a process from outside a container?
Situation: on user@host a qemu run and stack inside a container user@container
Is it normal:
to view with ps aux | grep qemu from user@host that the process run on user@container?
to be able to ...
1
vote
0answers
56 views
Securely retrieving and exposing configuration within Docker
It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
2
votes
2answers
382 views
Should the traffic between the containers need to be encrypted?
Should the traffic between two containers in same docker environment need to be encrypted ?
Is it possible for a container to snoop into the un-encrypted traffic between two containers ?
1
vote
1answer
394 views
osquery in Docker environment
I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security ...
0
votes
1answer
34 views
Do I need to trust my Paas provider?
I am currently entering the world of deploying my web application to the cloud.
While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The ...
5
votes
5answers
679 views
Should I remove bash from my Docker web app container?
Suppose I am a dev and want to harden my web application environment. If my application does not make use of binaries like sh, ls, find, echo etc. should I just remove them from my image?
1
vote
0answers
67 views
I had a (password protected) postgres docker container running on a public port for a few minutes [closed]
Could the server be compromised? I've deleted the container.
3
votes
2answers
82 views
What approaches exist for ensuring security when deploying software in non-trusted environments?
Is it possible to deploy software in such a way that a rogue actor who has physical access to the hardware is unable to glean any information on the code that is running or what is being stored in ...
5
votes
1answer
249 views
How secure is LXD compared to Docker?
I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?
3
votes
1answer
3k views
Is adding docker group not a good idea?
Question
Is creating a docker group could be a bad idea from security perspectives?
I saw stack exchange answers which tells to create docker group to avoid issues of needing root permission or sudo....
1
vote
1answer
351 views
Option to secure docker socket from containers
Objective
Understand the options to secure the docker.sock.
Background
As in those articles, giving containers the access to docker.sock is a risk.
Don't expose the Docker socket (not even to a ...
1
vote
1answer
949 views
How to find an appropriate SELinux type to prevent “permission denied”
Objective
Find out a solution to avoid the permission denied due to SELinux.
Background
Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
5
votes
2answers
212 views
How to build arbitrary Dockerfile Images Without Compromising Host
I'm building a server that will build images directly from Dockerfile:
docker build -t arbitrarydocker .
This docker file will be built on the same server as other client Dockerfiles, which may have ...
48
votes
1answer
9k views
How to mitigate Meltdown in Docker images?
On https://meltdownattack.com/ it is suggested that (in some cases?) scenarios with Docker containers are also vulnerable.
I'm a developer using Docker for two different purposes:
Images used for ...
8
votes
1answer
9k views
Docker runs container processes as root - should I be worried?
I am running a (QNAP) NAS with Docker functionality ("containerstation"). I thought it would be a lot safer to install apps via containers instead of apps from the store (or 3rd party stores).
Many ...
4
votes
1answer
75 views
Restrict compilation to certain machines
I am a software developer in a big company. I just realised that I could technically clone the repository of my employers git repository. The infrastructure is in docker images.
So technically this ...
4
votes
1answer
300 views
Security implications of adding nobody to docker group
A docker monitoring tool needs read access to the docker socket in order to collect stats. The setup instructions asks me to provide "Read-only access to the Docker socket" by running the following
...
0
votes
2answers
162 views
Run multiple AntiViruses with Dockers
I need to run multiple Antiviruses in my system. Inevitably I cannot. So, I thought docker is a good option. But I think it is not possible. Because Antiviruses are kernel-mode and the kernel is ...
0
votes
2answers
364 views
Docker secret security
I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my ...
2
votes
2answers
457 views
How to integrate client certificates for upstream servers with nginx as reverse proxy?
For my private VPS, I am building a configuration for different web applications (Owncloud,...) which depends on a combination of different Docker containers. At the front, I would like to use an ...
1
vote
0answers
279 views
Is it secure to enable KVM Device for Docker Runner in GitLab Continuous Integration?
I need to enable KVM for my android-ci Docker image to work for emulator based instrumentation tests. The Android emulator requires the kvm device.
Therefore I specify the following in the Runner ...
275
votes
9answers
39k views
What makes Docker more secure than VMs or bare metal?
I recently had a discussion with a Docker expert about the security of Docker vs. virtual machines. When I told that I've read from different sources that it's easier for code running within a Docker ...
2
votes
2answers
460 views
How to start OWASP Shepherd using Docker? [closed]
I have pulled the Security Shepherd Docker image and followed all the instructions for the Docker setup. I believe all steps were successful.
Now I don't know how to run the Shepherd application, ...
0
votes
1answer
396 views
Potential added risks of using Docker in production servers
What are the added security risks of using a dockerized container to deploy a production server?
Not interested in risks that would exist anyway in deploying a production server the traditional way,...
1
vote
1answer
1k views
Configuring docker securly on a developer machine
As a developer, I use docker and have a docker server running on my machine. I would expect that docker would not give my user permission to operate on files beyond my user's current set of ...
