Information Security

Questions tagged [docker]

Ask Question

Docker is a popular virtualization solution that provides virtualization within an operating system for reusable packages of software called containers. More information available at docker.com.

130 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

How to use ansible playbook to add new rules to snort docker container? [closed]

I have a snort docker container running on my network to detect attacks and i would like to use ansible to run a playbook to add a new rule to snort . I have installed ansible security ids rule on ...
0
votes
0answers
34 views

How do I get snort to detect traffic going to metasploitable docker container? [closed]

I have setup Snort and I have Metasploitable 2 running in a docker container on Centos 7 host. I am trying to get Snort to detect traffic traveling to the Metasploitable 2 container. I've tried ...
1
vote
1answer
58 views

Is Docker Desktop safe to use on a unsecured network?

I use Docker Desktop for Windows. I noticed it adds to my OS's host file <ip> host.docker.internal, where <ip> is the private machine IP for the connected local network. (This DNS name is ...
0
votes
0answers
45 views

securely using Nextcloud on raspberry pi

I like data privacy, so I would like to set up a system that allows me to exchange data such as photos with family and friends. I have a raspberry pi (version 4 I think? the one that was new in the ...
0
votes
1answer
48 views

Managing vulnerabilities in continuous delivery

When building my own Docker container, if I use a base image such as Debian 10.6 (stable) there are times when high vulnerabilities are found in the OS packages, that have not been fixed in this ...
0
votes
1answer
62 views

Is it a good idea to host a SFTP server within a dockerized environment with mounted host directories?

For platform hardware independence, a proposal to host a SFTP server within a containerized environment was being considered. A container or pod would have the server running within it, with mounted ...
0
votes
0answers
18 views

How to pin public root key when downloading an image with docker pull (Docker Content Trust)?

How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn't have a valid signature using the private key corresponding to (or subordinate to) the public ...
1
vote
1answer
51 views

How to list all of the known root keys in docker (Docker Content Trust)

How can I list all of the Docker Content Trust root keys on my system? I am setting up a CI process that will use the debian:stable-latest docker image to build my application's releases in ephemeral ...
0
votes
2answers
156 views

Docker: Not able to read local file system

I am inside the container, and I am trying to learn escaping from container to host. So I create a vulnerable environment, on which the container is having `/var/run/docker.sock' file inside the ...
3
votes
1answer
122 views

Is it possible to run commands that exist only on the host on a docker container?

We would like to harden our Docker Image and remove redundant software from it. Our Devs and Ops asked to keep some Linux tools used for debugging on the containers running on our Kubernetes Prod ...
0
votes
1answer
389 views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
1
vote
1answer
65 views

Host filesystem manipulation from docker vs. virtual machine

When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
1
vote
1answer
25 views

Security loopholes while mapping .kube/config file on to docker as volume

I have a scenario where I have to install Kubernetes on a public cloud and access the Kubernetes via kubectl from a VM on my laptop. Kubectl accesses .kube/config to connect K8S API-Server to do the ...
0
votes
1answer
90 views

Can malicious applications running inside a docker container still be harmful? [duplicate]

I am very new to docker (and don't usually program at a 'systems' level). I will be working on an open source project with complete strangers over the web over the next couple of months. I trust them, ...
0
votes
1answer
97 views

Do docker images have the same root password?

If two persons are pulling the same docker image (let's say Debian:10.4), they will obtain the same "files" (layers) from the docker repo. So, from what I understand, launching a docker ...
0
votes
1answer
172 views

Where to find complete Kali image for docker with all the tools? [closed]

As of now, I am using window 10 & I want to run kali Linux on Docker. For that, I took the copy from kali official site Here But after running I found it's just a base OS it doesn't contain all ...
1
vote
1answer
63 views

How do I share secret key files with Docker containers following 12 Factor App?

I am building an API and trying to follow the 12 Factor App methodology. Using Docker, the methodology says containers must be disposable. Assuming the API will have high traffic, multiple docker ...
2
votes
1answer
61 views

Podman: What if user is member of docker group?

From a security perspective: Is it necessary that a user, that runs OCI containers with Podman, is not at the same time a member of the docker group? From what I understand the idea behind Podman is ...
2
votes
1answer
67 views

Run docker as not sudoers

I have on my ubuntu instance a group of non-sudoers ("deploy" group). In order, to enable them to use docker I have to change the permission of "/var/run/docker.sock" file to chgrp deploy /var/run/...
2
votes
1answer
197 views

Buffer Overflow Works Locally But Not Remotely

So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
1
vote
0answers
195 views

Digital Ocean ENV Variables - .env file, ENV Variables, or something else

Does Digital Ocean have something similar to Credstash or AWS Secrets Manager (both AWS services)? Trying to decide on the most secure way to store environmental variables with sensitive information (...
1
vote
1answer
44 views

Does Google Cloud Run (or AWS Lambda) rely on container isolation or KVM?

I was wondering if it is secure or not to run containers from different customers on the same machine. Basically I was investigating the level of isolation / security provided by Docker alone. Then ...
2
votes
1answer
164 views

Secure Communication between Swarm Worker Nodes

I have a Swarm Cluster and want to communicate securely between Windows Worker Nodes. The official Docker Documentation (https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/) states: The ...
4
votes
1answer
497 views

I'm seeing strange names in my list of docker containers, is someone having fun at docker or is that from hackers?

I'm trying to run a docker and it fails for various reasons. As I check my list of dockers (docker ps -a), I see those names: pedantic_gauss recursing_feynman adoring_brattain suspicious_tesla ...
1
vote
0answers
105 views

How should I install Kali Linux on my Windows 10?

I'm using Windows 10. I found several ways to install Kali Linux on Win10: Install it on VMWare Install it on Docker Install it on Linux subsystem (WSL) I might need to access some files in my ...
3
votes
1answer
603 views

Is accessing /proc/ inside docker container a security breach?

In a docker container I am reading the files /proc/stat and /proc/meminfo. As I understand they are the ones of the host. (Not local to the docker container) In a meeting, a co-worker said that this ...
1
vote
1answer
109 views

Risk of Docker backdoor allowing impersonation

I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux. I work in a company which is developing some ...
2
votes
1answer
91 views

Does Docker affect the quality of cryptographic operations?

Is running cryptographic operations (encryption / decryption / signing / verifying / key-exchange / key-generation) in a Docker container affecting the quality of the crypto or entropy? If it does ...
2
votes
2answers
142 views

How do you handle vulnerabilities in internal systems?

A constant source of debate I've seen between engineers and security teams is how to handle vulnerabilities in internal systems. Specifically, vulnerabilities in linux packages (like gcc, libcurl, ...
10
votes
3answers
1k views

Can network traffic between Docker containers be sniffed?

On normal networks, it is a security risk to send plaintext data, since attackers can sniff or even manipulate all traffic. Encryption is required for secure communication. When using Docker ...
1
vote
0answers
113 views

Is it safe to run a Kubernetes container as a root user? [closed]

I run my Spring Boot (Java) application in the Kubernetes environment as a root user and with JMX authentication turned on. My k8s containers are being flagged as a security risk by the security ...
0
votes
0answers
55 views

Exploitation differences between Docker and VirtualBox for CVE-2010-4221

I am currently working on a research project where I analyze exploits in different virtualized environments. As an example I picked ProFTPd v1.3.3c which has a remote code execution vulnerability. I ...
3
votes
1answer
491 views

Secure elasticsearch in Docker [closed]

How can I secure elasticsearch for production use in Docker? I use this docker-compose.yml: version: '2' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:5.6.16 ...
6
votes
3answers
592 views

How to securely run Puppeteer / Chromium in a Docker container?

Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing. The problem is that, from ...
0
votes
1answer
172 views

Handling secrets and environmental variables in Docker-k8s-skaffold dev environment

Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it. Just ...
8
votes
1answer
1k views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
1
vote
1answer
81 views

Securing Code Secrets - What is the relevance if the host gets compromised?

I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
6
votes
3answers
1k views

Disable ASLR inside Docker container

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a ...
5
votes
1answer
332 views

What are the security implications of capabilities in Kubernetes pods?

We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities: ...
1
vote
2answers
186 views

Docker container which reads memory belonging to another container

The field of maliciously accessing another process's memory has been broadly studied in the Linux environment. But for some reason I am not able to find similar discussion/similarities for the ...
0
votes
1answer
246 views

Ssecure communication between Docker container and an Elasticsearch server?

I have a spring boot application running inside a Docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these ...
3
votes
1answer
3k views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...
1
vote
1answer
223 views

How to harden container hosts?

https://github.com/docker/docker-bench-security git clone https://github.com/docker/docker-bench-security.git cd docker-bench-security docker build --no-cache -t docker-bench-security . docker run -...
2
votes
1answer
2k views

CIS hardening of alpine based docker container

I've got a service running inside a docker container. I've built my own image based on nginx:stable-alpine docker image. I am trying to ascertain whether the concept of CIS hardening applies to the ...
3
votes
0answers
919 views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
0
votes
2answers
296 views

Securely compile foreign code and run it on a server?

I would like to set up a server that can receive source code directly, compile/interpret it and execute it. The code could be C#, Java, C++, C, Javascript, PHP... There will obviously be security ...
7
votes
1answer
1k views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
1
vote
0answers
279 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
2
votes
1answer
278 views

Containerization vs. Chroot in shared hosting

Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
8
votes
2answers
4k views

Docker: when to use apparmor vs seccomp vs --cap-drop

Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container. However I couldn't find any documentation or guideline on when to use which ...

1
2 3