Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [docker]

Docker is a popular virtualization solution that provides virtualization within an operating system for reusable packages of software called containers. More information available at docker.com.

Filter by
Sorted by
Tagged with
0 votes
2 answers
42 views

Docker, running programs as Root and AWS

It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the ...
user avatar
  • 101
2 votes
0 answers
43 views

Why I am unable to execute insmod on the docker container?

I have started an unprivileged docker container and trying to start the privileged exec session. It has CAP_SYS_MODULE capabilities, but still, I am getting operations not permitted in insmod. docker ...
user avatar
  • 121
0 votes
0 answers
23 views

When in a container do TCP API calls need TLS? [duplicate]

I have an application I'm building where all components will be contained inside a single container. I'm wondering about API calls within the container between the components, i.e using localhost, ...
user avatar
7 votes
2 answers
1k views

/opt and sudo unzip to /opt, is it safe?

Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
user avatar
2 votes
1 answer
47 views

Security of a ro volume in Docker

What are the security implications of mapping a host folder to a Docker container ro? For example -v /usr/local/bin:/usr/local/bin:ro. Of course, the container can now read the host folder. But, ...
user avatar
1 vote
1 answer
87 views

How does gVisor run its own kernel replacement under Docker for security? [closed]

I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security. My question is: The whole point ...
user avatar
2 votes
2 answers
113 views

Security of untrusted Docker containers

If I want to run untrusted code inside a Docker container, or an untrusted Docker container for that matter, how can I restrict it? I'd like to make sure it has no access to the host filesystem. ...
user avatar
0 votes
0 answers
56 views

Security implications of using HTTP for service to service communication within the same host [duplicate]

What are the security implications of using HTTP only for IPC for services within the same host? In my case, I am using docker-compose to host two ASP.NET Core services within the same host in Azure. ...
user avatar
0 votes
0 answers
81 views

Is the Docker cache a security risk due to stale base images?

I always thought that when I build the Dockerfile for my application, the latest version of the base image is downloaded from the registry (and in this way I have a fresh version with all the security ...
user avatar
1 vote
1 answer
166 views

Getting apparmor to profile a program inside docker container

I'm looking to profile a service running inside a specific docker container. I went through the documentation of aa-genprof and aa-autodep and both take program as input to profile. I can't seem to ...
user avatar
0 votes
0 answers
80 views

Docker: How to download & verify a publisher's root key (out-of-band, distinct-domain cryptographic verification, WoT)

For a given publisher of docker images on Docker Hub (let's say debian), how do I download their root release/image signing key and verify its authenticity from multiple sources out-of-band from each-...
user avatar
0 votes
0 answers
81 views

SECCOMP inside a docker container adds an extra layer of security?

Does hardening with SECCOMP a binary running inside a Docker container brings extra security? I can find many articles/papers about hardening the container itself but very few things about hardening ...
user avatar
0 votes
1 answer
185 views

Why Vulnerability Scanners Ignore Shared Libraries?

First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
user avatar
0 votes
0 answers
56 views

How to protect workload from host [duplicate]

I have some code and other resources which run in a container or VM ("black box") on a host machine. The host uses this as a service to process some files which are highly sensitive and ...
user avatar
  • 109
2 votes
3 answers
144 views

How can I pass secrets to a compromised container without the attacker being able to see them?

The most common method of passing secrets to a docker container is through ENVs. The problem is: Imagine that your docker container is hosting a HTTP server that can have a security exploit (like any ...
user avatar
  • 121
1 vote
2 answers
117 views

Logging docker container logins, EC2 Host

I have an AWS EC2 instance with docker installed, running a default nginx container - docker run -it --rm -d -p 8080:80 --name web nginx. I have an rsyslog setup that successfully captures the auth....
user avatar
  • 11
2 votes
1 answer
315 views

Kinsing Malware entering via compromised Dockerhub Images?

I got a server infected with the Kinsing malware, which mines crypto on your server, maxing out your CPUs. The malware initially creates the files /tmp/kdevtmpfs and /tmp/kinsing If you delete these ...
user avatar
  • 121
0 votes
2 answers
186 views

Remediating base image vulnerabilities

I'm trying to build a base image that pulls from php:7.3-fpm, which is built on debian:buster-slim. The php:7.3-fpm base image has vulnerabilities out of the box, like https://security-tracker.debian....
user avatar
  • 11
1 vote
1 answer
106 views

Do I need to keep production Docker/container images?

Context My company is developing a SaaS solution that needs to conform to PCI-DSS L1 for sure, and possibly FedRAMP and other frameworks later. We can do continuous deployment with feature flagged/...
user avatar
1 vote
2 answers
244 views

How to secure containerized python source code deployed at client side cloud

How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do ...
user avatar
  • 23
1 vote
0 answers
98 views

How to interpret received packets, although not being destination host

Set up: Victim: 192.168.0.2 Attacker (also having SSH server installed): 192.168.0.3 SSH server: 192.168.0.4 I perform a successful ARP Spoofing attack (being obviously the attacker's MAC address): ...
user avatar
1 vote
1 answer
476 views

Is docker for desktop secure for non-admins?

I manage a multi-user workstation (Windows) server for a small student organisation. One of the students asked me to install docker, as it would simplify his workflow. As this is on a shared ...
user avatar
  • 111
3 votes
0 answers
111 views

What are these requests that appear to be phoning home?

I have a .NET 5 application running on AWS which has these requests constantly attempting to run: GET http://app-10-irules.com/ GET http://www.simpleexample.com/ GET http://ssl-app-default-backend.com/...
user avatar
1 vote
1 answer
187 views

file-integrity monitoring tools for PCI compliance

A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
user avatar
  • 1,597
2 votes
1 answer
252 views

Securing docker containers on private LAN

I am using docker to run a few server apps on a raspberryPi with ports exposed to the open internet. If an attacker were to successfully infiltrate my docker containers, I would like to be certain ...
user avatar
  • 121
2 votes
1 answer
216 views

Docker container exposed port vulnerabilities on Debian server?

I'm configuring a Debian (Stretch) webserver to run docker containers for socks requests. So, the application would be able to authenticate (on port 1080) with the Dante server running inside the ...
user avatar
2 votes
1 answer
140 views

Container Vulnerability Management

Having difficulty understanding how to translate 'traditional' vulnerability management to a cloud environment. Previously accustomed to using tools like OpenVAS and Nessus, setting up scans which ...
user avatar
2 votes
2 answers
219 views

How are docker containers affected by CVE-2021-3156?

Do docker (web service/server)s run unattended updates? Otherwise, how to do this? I am worried about the recent sudo -s CVE. How are docker containers affected? If I set up an auditing system with ...
user avatar
0 votes
2 answers
167 views

Which attacks are prevented by switching the user within the docker container, given a read-only root fs?

There are recommendations to run processes as a non-privileged user within the docker container: [...] run your processes as non-privileged users inside the container See: docs.docker.com, also 1, 2 ...
user avatar
  • 3,892
0 votes
1 answer
163 views

How to start pentesting/reverse engineering/cracking a software on Linux? (Docker based) [closed]

TL:DR; What are good learning resources for security testing a software which runs with Docker on Ubuntu. I am in junior position at this company, and they figured it would be good if I just test ...
user avatar
11 votes
2 answers
4k views

Security implications of granting non-root access to privileged ports (<1024)

Lots of solutions to this problem e.g. here and here but in order to decide which is best I'd need to know more about the security implications of each solution (or at least in general). My context: I'...
user avatar
2 votes
1 answer
180 views

Is HTTPS meaningful for Jenkins Docker container behind Nginx?

I have a Docker Compose setup that starts up Nexus, Jenkins and Nginx containers. All calls to Jenkins and Nexus must pass through Nginx. I accomplish this by only port forwarding the Nginx container....
user avatar
1 vote
0 answers
173 views

Is there any value in using macvlan/VLANs to create router aware networks to segment internet exposed containers vs non exposed containers?

I have a single home server with a single NIC. I intend to run numerous Docker containers -- some will be internet exposed, some will not. The way I see it, I have two options: Use the normal bridge ...
user avatar
4 votes
1 answer
374 views

Privilege escalation writing /etc/passwd but without SUID permission on su

This is not an exercise, there might be no solution. We are producing a Docker image (based on CentOS) which is designed to be executed by a non-root user. However, this user has write access to /etc/...
user avatar
  • 41
1 vote
0 answers
322 views

How docker is translating docker0 interface ip address to host ip address

I'm trying to create a lab environment to experiment with MiTM attacks. I want to learn docker also so I've decided to do this with docker. I created 2 images (attacker, victim): Victim - based on ...
user avatar
1 vote
0 answers
80 views

Running non-root process in docker vs bare metal

Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container. Reasoning behind that is that ...
user avatar
  • 197
1 vote
1 answer
199 views

Is Docker Desktop safe to use on a unsecured network?

I use Docker Desktop for Windows. I noticed it adds to my OS's host file <ip> host.docker.internal, where <ip> is the private machine IP for the connected local network. (This DNS name is ...
user avatar
  • 393
0 votes
0 answers
211 views

securely using Nextcloud on raspberry pi

I like data privacy, so I would like to set up a system that allows me to exchange data such as photos with family and friends. I have a raspberry pi (version 4 I think? the one that was new in the ...
user avatar
  • 101
0 votes
1 answer
167 views

Managing vulnerabilities in continuous delivery

When building my own Docker container, if I use a base image such as Debian 10.6 (stable) there are times when high vulnerabilities are found in the OS packages, that have not been fixed in this ...
user avatar
  • 3
0 votes
1 answer
2k views

Is it a good idea to host a SFTP server within a dockerized environment with mounted host directories?

For platform hardware independence, a proposal to host a SFTP server within a containerized environment was being considered. A container or pod would have the server running within it, with mounted ...
user avatar
0 votes
1 answer
94 views

How to pin public root key when downloading an image with docker pull (Docker Content Trust)?

How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn't have a valid signature using the private key corresponding to (or subordinate to) the public ...
user avatar
2 votes
1 answer
236 views

How to list all of the known root keys in docker (Docker Content Trust)

How can I list all of the Docker Content Trust root keys on my system? I am setting up a CI process that will use the debian:stable-latest docker image to build my application's releases in ephemeral ...
user avatar
0 votes
2 answers
1k views

Docker: Not able to read local file system

I am inside the container, and I am trying to learn escaping from container to host. So I create a vulnerable environment, on which the container is having `/var/run/docker.sock' file inside the ...
user avatar
3 votes
1 answer
577 views

Is it possible to run commands that exist only on the host on a docker container?

We would like to harden our Docker Image and remove redundant software from it. Our Devs and Ops asked to keep some Linux tools used for debugging on the containers running on our Kubernetes Prod ...
user avatar
1 vote
1 answer
3k views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
user avatar
1 vote
1 answer
139 views

Host filesystem manipulation from docker vs. virtual machine

When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
user avatar
  • 111
1 vote
1 answer
71 views

Security loopholes while mapping .kube/config file on to docker as volume

I have a scenario where I have to install Kubernetes on a public cloud and access the Kubernetes via kubectl from a VM on my laptop. Kubectl accesses .kube/config to connect K8S API-Server to do the ...
user avatar
  • 111
0 votes
1 answer
641 views

Can malicious applications running inside a docker container still be harmful? [duplicate]

I am very new to docker (and don't usually program at a 'systems' level). I will be working on an open source project with complete strangers over the web over the next couple of months. I trust them, ...
user avatar
  • 103
0 votes
1 answer
536 views

Do docker images have the same root password?

If two persons are pulling the same docker image (let's say Debian:10.4), they will obtain the same "files" (layers) from the docker repo. So, from what I understand, launching a docker ...
user avatar
  • 1,336
2 votes
1 answer
1k views

Where to find complete Kali image for docker with all the tools? [closed]

As of now, I am using Windows 10 & I want to run kali Linux on Docker. For that, I took the copy from the kali official site Here But after running I found it's just a base OS it doesn't contain ...
user avatar