Questions tagged [docker]
Docker is a popular virtualization solution that provides virtualization within an operating system for reusable packages of software called containers. More information available at docker.com.
175
questions
0
votes
3
answers
30
views
Authenticating a request from a valid application (unshadowed)
I am working on an application which has an architectural description as below,
There is a docker container, lets say Microservice-A, in which multiple processes are running. Each process is ...
0
votes
0
answers
3
views
docker file does not execute [migrated]
I am trying to perform some test on vulnerable docker https://hub.docker.com/r/vulnerables/cve-2014-6271 but the docker is not actually executing. I Tested other docker images and they are working.
...
- 36
2
votes
1
answer
59
views
Is it safe to use Python's secrets module in a fresh docker container?
If I create a new Docker container based on a recent Debian image, and if use this container to generate a cryptographic key using Python's secrets module, then is that key safe to use?
My ...
- 123
1
vote
2
answers
61
views
How do you share private keys for signing e.g. JWTs inside Docker-Containers?
I've written an application in NodeJS which essentially only performs a login:
You send your username/password, and you retrieve an JWT (JSON Web Token).
Those tokens are being signed by a private key....
- 13
3
votes
1
answer
113
views
Docker Apache - safe to chown /usr/local/apache2 to non-root user?
I would like to run the official Docker Apache image as a non-root user. To make it work, it seems like it is necessary to chown the /usr/local/apache2 directory (see this and this):
chown -hR appuser:...
- 153
0
votes
1
answer
15
views
ZipSlip directory traversal cannot reach root directory
I have discovered a ZipSlip vulnerability in a web application. Simply put, ZipSlip is basically a directory traversal through a specially crafted zip file, which is made to contain "../" ...
0
votes
2
answers
43
views
Does AWS security group block unintentionally exposed ports from Docker?
My typical cloud server hardening includes blocking ports at the UFW level on the server as well as at the AWS security group level.
I recently learned that Docker overwrites your IPTables. Given that,...
- 59
1
vote
1
answer
52
views
Is better for security to not run Nginx and Backend inside docker but use docker only for database and not external exposed services?
I'm not a Docker specialist, I know how to install, configure and do only basic Docker hardening based on Docker official documentation.
I know nothing about AppArmor,SELinux and GRSEC.
But i need to ...
- 11
1
vote
1
answer
27
views
How do you control restrict actions within Docker without Kubernetes?
Based on the documentation here https://docs.docker.com/engine/security/, it does not seem that there are any built-in features to restrict the current logged-in user to run certain Docker commands.
...
- 59
1
vote
1
answer
58
views
What is the easiest way to find non-vulnerable container images?
I am fairly new to container image vulnerability scanning. There seem to be a lot of tools (Snyk, Trivvy, Clair, e.g.) that can identify vulnerable packages in container images. They also do a good ...
- 123
1
vote
1
answer
56
views
Can a container with CAP_NET_ADMIN access the host namespace
I have a docker container that I run by adding the extra privilege of CAP_NET_ADMIN in addition to the default ones. If I don’t share the host net namespace with the container, the host namespace is ...
- 111
0
votes
1
answer
32
views
Docker container can't access systemd service because of firewall
I'm in a somewhat weird situation that I don't understand:
I use ufw as a firewall. It's setup to drop any input connections apart from ssh
I have a service running locally (managed through systemd) ...
- 125
0
votes
0
answers
155
views
How to intercept traffic between two Docker containers
I'm trying to test a man-in-the-middle attack between two Docker containers.
The local virtual machine has two containers with the same bridging network, I 'm trying to use burpsuite to intercept ...
- 1
0
votes
2
answers
61
views
Docker, running programs as Root and AWS
It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the ...
- 101
3
votes
1
answer
275
views
Why I am unable to execute insmod on the docker container?
I have started an unprivileged docker container and trying to start the privileged exec session. It has CAP_SYS_MODULE capabilities, but still, I am getting operations not permitted in insmod.
docker ...
- 131
0
votes
0
answers
31
views
When in a container do TCP API calls need TLS? [duplicate]
I have an application I'm building where all components will be contained inside a single container. I'm wondering about API calls within the container between the components, i.e using localhost, ...
7
votes
2
answers
1k
views
/opt and sudo unzip to /opt, is it safe?
Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
- 405
2
votes
1
answer
62
views
Security of a ro volume in Docker
What are the security implications of mapping a host folder to a Docker container ro? For example -v /usr/local/bin:/usr/local/bin:ro.
Of course, the container can now read the host folder. But, ...
- 245
1
vote
1
answer
120
views
How does gVisor run its own kernel replacement under Docker for security? [closed]
I learned about gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security.
My question is: The whole point ...
- 245
2
votes
2
answers
179
views
Security of untrusted Docker containers
If I want to run untrusted code inside a Docker container, or an untrusted Docker container for that matter, how can I restrict it?
I'd like to make sure it has no access to the host filesystem. ...
- 245
0
votes
0
answers
60
views
Security implications of using HTTP for service to service communication within the same host [duplicate]
What are the security implications of using HTTP only for IPC for services within the same host?
In my case, I am using docker-compose to host two ASP.NET Core services within the same host in Azure.
...
- 101
1
vote
1
answer
245
views
Getting apparmor to profile a program inside docker container
I'm looking to profile a service running inside a specific docker container. I went through the documentation of aa-genprof and aa-autodep and both take program as input to profile. I can't seem to ...
0
votes
0
answers
87
views
Docker: How to download & verify a publisher's root key (out-of-band, distinct-domain cryptographic verification, WoT)
For a given publisher of docker images on Docker Hub (let's say debian), how do I download their root release/image signing key and verify its authenticity from multiple sources out-of-band from each-...
- 844
0
votes
1
answer
217
views
Why Vulnerability Scanners Ignore Shared Libraries?
First of all, I am new to vulnerability scanning and don't have an experience working with any tooling outside of container specific. So, I don't know if it is a normal behavior for scanners. Please ...
- 3
0
votes
0
answers
58
views
How to protect workload from host [duplicate]
I have some code and other resources which run in a container or VM ("black box") on a host machine. The host uses this as a service to process some files which are highly sensitive and ...
- 109
2
votes
3
answers
167
views
How can I pass secrets to a compromised container without the attacker being able to see them?
The most common method of passing secrets to a docker container is through ENVs.
The problem is:
Imagine that your docker container is hosting a HTTP server that can have a security exploit (like any ...
- 121
1
vote
2
answers
125
views
Logging docker container logins, EC2 Host
I have an AWS EC2 instance with docker installed, running a default nginx container - docker run -it --rm -d -p 8080:80 --name web nginx.
I have an rsyslog setup that successfully captures the auth....
- 11
3
votes
1
answer
369
views
Kinsing Malware entering via compromised Dockerhub Images?
I got a server infected with the Kinsing malware, which mines crypto on your server, maxing out your CPUs.
The malware initially creates the files /tmp/kdevtmpfs and /tmp/kinsing If you delete these ...
- 131
0
votes
2
answers
314
views
Remediating base image vulnerabilities
I'm trying to build a base image that pulls from php:7.3-fpm, which is built on debian:buster-slim. The php:7.3-fpm base image has vulnerabilities out of the box, like https://security-tracker.debian....
- 11
1
vote
1
answer
118
views
Do I need to keep production Docker/container images?
Context
My company is developing a SaaS solution that needs to conform to PCI-DSS L1 for sure, and possibly FedRAMP and other frameworks later.
We can do continuous deployment with feature flagged/...
- 13
1
vote
2
answers
353
views
How to secure containerized python source code deployed at client side cloud
How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do ...
- 23
1
vote
0
answers
98
views
How to interpret received packets, although not being destination host
Set up:
Victim: 192.168.0.2
Attacker (also having SSH server installed): 192.168.0.3
SSH server: 192.168.0.4
I perform a successful ARP Spoofing attack (being obviously the attacker's MAC address):
...
2
votes
1
answer
644
views
Is docker for desktop secure for non-admins?
I manage a multi-user workstation (Windows) server for a small student organisation. One of the students asked me to install docker, as it would simplify his workflow. As this is on a shared ...
- 121
2
votes
0
answers
115
views
What are these requests that appear to be phoning home?
I have a .NET 5 application running on AWS which has these requests constantly attempting to run:
GET http://app-10-irules.com/
GET http://www.simpleexample.com/
GET http://ssl-app-default-backend.com/...
- 21
1
vote
1
answer
228
views
file-integrity monitoring tools for PCI compliance
A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
- 1,646
2
votes
1
answer
301
views
Securing docker containers on private LAN
I am using docker to run a few server apps on a raspberryPi with ports exposed to the open internet. If an attacker were to successfully infiltrate my docker containers, I would like to be certain ...
- 121
2
votes
1
answer
282
views
Docker container exposed port vulnerabilities on Debian server?
I'm configuring a Debian (Stretch) webserver to run docker containers for socks requests. So, the application would be able to authenticate (on port 1080) with the Dante server running inside the ...
- 23
2
votes
1
answer
156
views
Container Vulnerability Management
Having difficulty understanding how to translate 'traditional' vulnerability management to a cloud environment. Previously accustomed to using tools like OpenVAS and Nessus, setting up scans which ...
- 123
2
votes
2
answers
239
views
How are docker containers affected by CVE-2021-3156?
Do docker (web service/server)s run unattended updates? Otherwise, how to do this? I am worried about the recent sudo -s CVE. How are docker containers affected? If I set up an auditing system with ...
- 51
0
votes
2
answers
185
views
Which attacks are prevented by switching the user within the docker container, given a read-only root fs?
There are recommendations to run processes as a non-privileged user within the docker container:
[...] run your processes as non-privileged users inside the container
See: docs.docker.com, also 1, 2
...
- 3,902
0
votes
1
answer
179
views
How to start pentesting/reverse engineering/cracking a software on Linux? (Docker based) [closed]
TL:DR; What are good learning resources for security testing a software which runs with Docker on Ubuntu.
I am in junior position at this company, and they figured it would be good if I just test ...
11
votes
2
answers
4k
views
Security implications of granting non-root access to privileged ports (<1024)
Lots of solutions to this problem e.g. here and here but in order to decide which is best I'd need to know more about the security implications of each solution (or at least in general).
My context: I'...
- 121
2
votes
1
answer
218
views
Is HTTPS meaningful for Jenkins Docker container behind Nginx?
I have a Docker Compose setup that starts up Nexus, Jenkins and Nginx containers. All calls to Jenkins and Nexus must pass through Nginx. I accomplish this by only port forwarding the Nginx container....
- 155
1
vote
0
answers
223
views
Is there any value in using macvlan/VLANs to create router aware networks to segment internet exposed containers vs non exposed containers?
I have a single home server with a single NIC. I intend to run numerous Docker containers -- some will be internet exposed, some will not.
The way I see it, I have two options:
Use the normal bridge ...
- 145
4
votes
1
answer
451
views
Privilege escalation writing /etc/passwd but without SUID permission on su
This is not an exercise, there might be no solution.
We are producing a Docker image (based on CentOS) which is designed to be executed by a non-root user.
However, this user has write access to /etc/...
- 41
1
vote
0
answers
346
views
How docker is translating docker0 interface ip address to host ip address
I'm trying to create a lab environment to experiment with MiTM attacks. I want to learn docker also so I've decided to do this with docker. I created 2 images (attacker, victim):
Victim - based on ...
- 11
1
vote
0
answers
91
views
Running non-root process in docker vs bare metal
Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container.
Reasoning behind that is that ...
- 217
1
vote
1
answer
235
views
Is Docker Desktop safe to use on a unsecured network?
I use Docker Desktop for Windows. I noticed it adds to my OS's host file <ip> host.docker.internal, where <ip> is the private machine IP for the connected local network. (This DNS name is ...
- 393
0
votes
0
answers
232
views
securely using Nextcloud on raspberry pi
I like data privacy, so I would like to set up a system that allows me to exchange data such as photos with family and friends. I have a raspberry pi (version 4 I think? the one that was new in the ...
- 101
0
votes
1
answer
184
views
Managing vulnerabilities in continuous delivery
When building my own Docker container, if I use a base image such as Debian 10.6 (stable) there are times when high vulnerabilities are found in the OS packages, that have not been fixed in this ...
- 3