Questions tagged [docker]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
69 views

Secure Communication between Swarm Worker Nodes

I have a Swarm Cluster and want to communicate securely between Windows Worker Nodes. The official Docker Documentation (https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/) states: The ...
2
votes
1answer
114 views

I'm seeing strange names in my list of docker containers, is someone having fun at docker or is that from hackers?

I'm trying to run a docker and it fails for various reasons. As I check my list of dockers (docker ps -a), I see those names: pedantic_gauss recursing_feynman adoring_brattain suspicious_tesla ...
1
vote
0answers
75 views

How should I install Kali Linux on my Windows 10?

I'm using Windows 10. I found several ways to install Kali Linux on Win10: Install it on VMWare Install it on Docker Install it on Linux subsystem (WSL) I might need to access some files in my ...
3
votes
1answer
123 views

Is accessing /proc/ inside docker container a security breach?

In a docker container I am reading the files /proc/stat and /proc/meminfo. As I understand they are the ones of the host. (Not local to the docker container) In a meeting, a co-worker said that this ...
1
vote
1answer
100 views

Risk of Docker backdoor allowing impersonation

I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux. I work in a company which is developing some ...
2
votes
1answer
87 views

Does Docker affect the quality of cryptographic operations?

Is running cryptographic operations (encryption / decryption / signing / verifying / key-exchange / key-generation) in a Docker container affecting the quality of the crypto or entropy? If it does ...
2
votes
2answers
130 views

How do you handle vulnerabilities in internal systems?

A constant source of debate I've seen between engineers and security teams is how to handle vulnerabilities in internal systems. Specifically, vulnerabilities in linux packages (like gcc, libcurl, ...
10
votes
3answers
629 views

Can network traffic between Docker containers be sniffed?

On normal networks, it is a security risk to send plaintext data, since attackers can sniff or even manipulate all traffic. Encryption is required for secure communication. When using Docker ...
1
vote
0answers
82 views

Is it safe to run a Kubernetes container as a root user? [closed]

I run my Spring Boot (Java) application in the Kubernetes environment as a root user and with JMX authentication turned on. My k8s containers are being flagged as a security risk by the security ...
0
votes
0answers
45 views

Exploitation differences between Docker and VirtualBox for CVE-2010-4221

I am currently working on a research project where I analyze exploits in different virtualized environments. As an example I picked ProFTPd v1.3.3c which has a remote code execution vulnerability. I ...
3
votes
1answer
214 views

Secure elasticsearch in Docker [closed]

How can I secure elasticsearch for production use in Docker? I use this docker-compose.yml: version: '2' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:5.6.16 ...
0
votes
0answers
22 views

Degraded security of identical TLS keypairs when orchestrating containers?

In an orchestrated container environment such as Kubernetes, is it meaningful to have TLS-enabled connections from the load-balancer (LB) to the pods if you plan to auto-scale horizontally? ...
0
votes
0answers
15 views

Dockerfile - What user should be the owner for a mount point?

In the docker-compose file, below is the volumes instruction for builder service: builder: build: ../../ dockerfile: docker/dev/Dockerfile volumes: - ../../target:/wheelhouse volumes_from:...
2
votes
2answers
188 views

How to securely run Puppeteer / Chromium in a Docker container?

Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing. The problem is that, from ...
0
votes
1answer
95 views

Handling secrets and environmental variables in Docker-k8s-skaffold dev environment

Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it. Just ...
6
votes
1answer
263 views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
1
vote
1answer
69 views

Securing Code Secrets - What is the relevance if the host gets compromised?

I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
4
votes
2answers
596 views

Disable ASLR inside Docker container

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a ...
4
votes
1answer
225 views

What are the security implications of capabilities in Kubernetes pods?

We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities: ...
0
votes
2answers
155 views

Docker container which reads memory belonging to another container

The field of maliciously accessing another process's memory has been broadly studied in the Linux environment. But for some reason I am not able to find similar discussion/similarities for the ...
0
votes
1answer
230 views

Ssecure communication between Docker container and an Elasticsearch server?

I have a spring boot application running inside a Docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these ...
2
votes
1answer
2k views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...
1
vote
1answer
209 views

How to harden container hosts?

https://github.com/docker/docker-bench-security git clone https://github.com/docker/docker-bench-security.git cd docker-bench-security docker build --no-cache -t docker-bench-security . docker run -...
2
votes
1answer
1k views

CIS hardening of alpine based docker container

I've got a service running inside a docker container. I've built my own image based on nginx:stable-alpine docker image. I am trying to ascertain whether the concept of CIS hardening applies to the ...
2
votes
0answers
829 views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
0
votes
2answers
166 views

Securely compile foreign code and run it on a server?

I would like to set up a server that can receive source code directly, compile/interpret it and execute it. The code could be C#, Java, C++, C, Javascript, PHP... There will obviously be security ...
7
votes
1answer
750 views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
1
vote
0answers
252 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
2
votes
1answer
177 views

Containerization vs. Chroot in shared hosting

Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
7
votes
2answers
3k views

Docker: when to use apparmor vs seccomp vs --cap-drop

Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container. However I couldn't find any documentation or guideline on when to use which ...
1
vote
1answer
111 views

Security (IP discovering) on Kubernetes

I'm trying to improve my security knowledge on containers environments. Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
0
votes
1answer
504 views

watch DNS queries while using OpenVPN.-

I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client. My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
6
votes
1answer
335 views

What's the risk from enabling ptrace in docker?

Solutions for various problems (e.g., here and here) suggest enabling SYS_PTRACE when running a container that, say, needs to run a debugger or a fuzzer. Given that the capability isn't enabled by ...
1
vote
1answer
46 views

What is needed to secure a docker container that's running on nodes in an AWS Private Subnet with internet access only via NAT?

I know securing a container is a big deal and a lot is needed to be done to secure a default container configuration. But having it in a private subnet should take care of a lots of risks. So what ...
6
votes
2answers
3k views

Where to find the security hardened docker images

Is there any service that provides certified, security hardened Docker images for common platforms like Python, PHP, Node, Java, etc. with 0 major/critical CVEs. Currently, we are using the ones from ...
3
votes
1answer
966 views

Running Docker container as Root user

Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear: Is it still the same kind of insecure even if the container cannot ...
2
votes
2answers
84 views

Can sharing docker info compromise security?

Running docker info gives a result such as this: $ docker info Containers: 1 Running: 0 Paused: 0 Stopped: 1 Images: 2 Server Version: 18.06.1-ce Storage Driver: overlay2 Backing Filesystem: ...
1
vote
2answers
328 views

Add main user account to docker group

I recently installed ubuntu on my home system. As I am going to mainly use it for machine learning research, I tried to set up a python environment. I tried doing this with docker to make things ...
0
votes
1answer
105 views

What would be reasonable approach for sandboxing new project to be protected against security holes made by chance?

As a regular developer I'm curious about looking at new projects. Let's say today I want to contribute to open source project in Python. This project is on GitHub and I a kind of confident in people ...
0
votes
1answer
2k views

Docker + AV on the host

I've dug through some history of this site (which inevitably means someone will post how I missed it) and didn't find anything directly relating to my question. What has been the typical solution ...
4
votes
3answers
793 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
0
votes
3answers
386 views

Is it risky to mount tmpfs volumes in Docker?

Sometimes I need to run I/O intensive operations in memory. The tmpfs facility works really well for this, but I was wondering if there are any big risks of using tmpfs mounts inside a container. Can ...
4
votes
2answers
530 views

How to prevent a docker container from being attached by multiple users?

When you run docker containers you can list running containers by using docker ps Then you can attach them by docker attach <container id> The trouble is that all people that can attach the ...
0
votes
1answer
191 views

Is it normal to being able to kill a process from outside a container?

Situation: on user@host a qemu run and stack inside a container user@container Is it normal: to view with ps aux | grep qemu from user@host that the process run on user@container? to be able to ...
1
vote
1answer
76 views

Securely retrieving and exposing configuration within Docker

It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
3
votes
2answers
543 views

Should the traffic between the containers need to be encrypted?

Should the traffic between two containers in same docker environment need to be encrypted ? Is it possible for a container to snoop into the un-encrypted traffic between two containers ?
1
vote
1answer
555 views

osquery in Docker environment

I am currently researching security monitoring in Docker environments and want to explore the possibility of using osquery to gather activity from containers, but I have run into a bit of a security ...
0
votes
1answer
36 views

Do I need to trust my Paas provider?

I am currently entering the world of deploying my web application to the cloud. While trying out Paas providers like heroku, I realized, that the platform has full access to my application. The ...
5
votes
5answers
1k views

Should I remove bash from my Docker web app container?

Suppose I am a dev and want to harden my web application environment. If my application does not make use of binaries like sh, ls, find, echo etc. should I just remove them from my image?
1
vote
0answers
74 views

I had a (password protected) postgres docker container running on a public port for a few minutes [closed]

Could the server be compromised? I've deleted the container.