Questions tagged [docker]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
45 views

What is / are the best threat modeling method(s) for container security?

I am currently researching threat modeling for container security, I am wondering which methods are the best for container security. Till now I got the conclusion that STRIDE is most used and it is ...
5
votes
1answer
260 views

What are the security implications of capabilities in Kubernetes pods?

We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities: ...
2
votes
1answer
81 views

Securely retrieving and exposing configuration within Docker

It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
6
votes
3answers
806 views

Disable ASLR inside Docker container

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a ...
2
votes
1answer
102 views

Buffer Overflow Works Locally But Not Remotely

So I made a simple buffer overflow challenge and attempted to host it on a digitalocean droplet. The challenge source is below, and is compiled using gcc welcome.c -fno-stack-protector -no-pie -o ...
0
votes
0answers
52 views

Digital Ocean ENV Variables - .env file, ENV Variables, or something else

Does Digital Ocean have something similar to Credstash or AWS Secrets Manager (both AWS services)? Trying to decide on the most secure way to store environmental variables with sensitive information (...
3
votes
1answer
213 views

Is accessing /proc/ inside docker container a security breach?

In a docker container I am reading the files /proc/stat and /proc/meminfo. As I understand they are the ones of the host. (Not local to the docker container) In a meeting, a co-worker said that this ...
0
votes
0answers
24 views

Does Google Cloud Run (or AWS Lambda) rely on container isolation or KVM?

I was wondering if it is secure or not to run containers from different customers on the same machine. Basically I was investigating the level of isolation / security provided by Docker alone. Then ...
4
votes
2answers
307 views

How to securely run Puppeteer / Chromium in a Docker container?

Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing. The problem is that, from ...
2
votes
1answer
1k views

CIS hardening of alpine based docker container

I've got a service running inside a docker container. I've built my own image based on nginx:stable-alpine docker image. I am trying to ascertain whether the concept of CIS hardening applies to the ...
3
votes
1answer
137 views

I'm seeing strange names in my list of docker containers, is someone having fun at docker or is that from hackers?

I'm trying to run a docker and it fails for various reasons. As I check my list of dockers (docker ps -a), I see those names: pedantic_gauss recursing_feynman adoring_brattain suspicious_tesla ...
4
votes
3answers
839 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
39
votes
3answers
18k views

Docker as a sandbox for untrusted code

I have created a web application that among other things allows users to write, compile and execute code (Java, C#). The application creates a Docker container for every user where compilation and ...
2
votes
1answer
103 views

Secure Communication between Swarm Worker Nodes

I have a Swarm Cluster and want to communicate securely between Windows Worker Nodes. The official Docker Documentation (https://docs.docker.com/engine/swarm/how-swarm-mode-works/pki/) states: The ...
1
vote
0answers
88 views

How should I install Kali Linux on my Windows 10?

I'm using Windows 10. I found several ways to install Kali Linux on Win10: Install it on VMWare Install it on Docker Install it on Linux subsystem (WSL) I might need to access some files in my ...
0
votes
1answer
237 views

Ssecure communication between Docker container and an Elasticsearch server?

I have a spring boot application running inside a Docker container. This application communicates with another server which hosts Elasticsearch on it. How do I secure the communication between these ...
1
vote
1answer
106 views

Risk of Docker backdoor allowing impersonation

I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux. I work in a company which is developing some ...
6
votes
1answer
468 views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
7
votes
1answer
394 views

What's the risk from enabling ptrace in docker?

Solutions for various problems (e.g., here and here) suggest enabling SYS_PTRACE when running a container that, say, needs to run a debugger or a fuzzer. Given that the capability isn't enabled by ...
290
votes
9answers
43k views

What makes Docker more secure than VMs or bare metal?

I recently had a discussion with a Docker expert about the security of Docker vs. virtual machines. When I told that I've read from different sources that it's easier for code running within a Docker ...
2
votes
1answer
87 views

Does Docker affect the quality of cryptographic operations?

Is running cryptographic operations (encryption / decryption / signing / verifying / key-exchange / key-generation) in a Docker container affecting the quality of the crypto or entropy? If it does ...
10
votes
3answers
845 views

Can network traffic between Docker containers be sniffed?

On normal networks, it is a security risk to send plaintext data, since attackers can sniff or even manipulate all traffic. Encryption is required for secure communication. When using Docker ...
2
votes
2answers
131 views

How do you handle vulnerabilities in internal systems?

A constant source of debate I've seen between engineers and security teams is how to handle vulnerabilities in internal systems. Specifically, vulnerabilities in linux packages (like gcc, libcurl, ...
1
vote
0answers
92 views

Is it safe to run a Kubernetes container as a root user? [closed]

I run my Spring Boot (Java) application in the Kubernetes environment as a root user and with JMX authentication turned on. My k8s containers are being flagged as a security risk by the security ...
0
votes
0answers
48 views

Exploitation differences between Docker and VirtualBox for CVE-2010-4221

I am currently working on a research project where I analyze exploits in different virtualized environments. As an example I picked ProFTPd v1.3.3c which has a remote code execution vulnerability. I ...
3
votes
1answer
294 views

Secure elasticsearch in Docker [closed]

How can I secure elasticsearch for production use in Docker? I use this docker-compose.yml: version: '2' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:5.6.16 ...
0
votes
0answers
22 views

Degraded security of identical TLS keypairs when orchestrating containers?

In an orchestrated container environment such as Kubernetes, is it meaningful to have TLS-enabled connections from the load-balancer (LB) to the pods if you plan to auto-scale horizontally? ...
0
votes
0answers
19 views

Dockerfile - What user should be the owner for a mount point?

In the docker-compose file, below is the volumes instruction for builder service: builder: build: ../../ dockerfile: docker/dev/Dockerfile volumes: - ../../target:/wheelhouse volumes_from:...
0
votes
1answer
125 views

Handling secrets and environmental variables in Docker-k8s-skaffold dev environment

Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it. Just ...
6
votes
2answers
3k views

Where to find the security hardened docker images

Is there any service that provides certified, security hardened Docker images for common platforms like Python, PHP, Node, Java, etc. with 0 major/critical CVEs. Currently, we are using the ones from ...
34
votes
4answers
14k views

Passing secret keys securely to docker containers

I want to pass a secret value needed by an app that runs in a Docker container. This particular container is short-lived -- it starts up, runs a command, and then terminates. Method 1: Pass the ...
1
vote
1answer
73 views

Securing Code Secrets - What is the relevance if the host gets compromised?

I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
2
votes
2answers
2k views

Hide Docker Containers Behind VPN

I want to run all services within Docker containers (including RA and site-to-site VPN) such that all containers except the VPN are not exposed on the public IP, but are reachable on the VPN IP. This ...
1
vote
1answer
212 views

How to harden container hosts?

https://github.com/docker/docker-bench-security git clone https://github.com/docker/docker-bench-security.git cd docker-bench-security docker build --no-cache -t docker-bench-security . docker run -...
2
votes
1answer
2k views

How to find an appropriate SELinux type to prevent “permission denied”

Objective Find out a solution to avoid the permission denied due to SELinux. Background Deployed a docker container which mounts the host file /var/run/docker but cannot access it within the ...
1
vote
1answer
46 views

What is needed to secure a docker container that's running on nodes in an AWS Private Subnet with internet access only via NAT?

I know securing a container is a big deal and a lot is needed to be done to secure a default container configuration. But having it in a private subnet should take care of a lots of risks. So what ...
3
votes
1answer
2k views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...
0
votes
2answers
161 views

Docker container which reads memory belonging to another container

The field of maliciously accessing another process's memory has been broadly studied in the Linux environment. But for some reason I am not able to find similar discussion/similarities for the ...
1
vote
1answer
113 views

Security (IP discovering) on Kubernetes

I'm trying to improve my security knowledge on containers environments. Recently I was playing around with Kubernetes cluster. I saw this absolutely awesome link: https://schd.ws/hosted_files/...
0
votes
2answers
198 views

Securely compile foreign code and run it on a server?

I would like to set up a server that can receive source code directly, compile/interpret it and execute it. The code could be C#, Java, C++, C, Javascript, PHP... There will obviously be security ...
7
votes
2answers
3k views

Docker: when to use apparmor vs seccomp vs --cap-drop

Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container. However I couldn't find any documentation or guideline on when to use which ...
2
votes
0answers
862 views

Use self-signed certificate inside of Docker Container for localhost

I've created a self-signed certificate for localhost to use https. I'm running an Apache Docker container which uses the self-signed certificate and the private key. I then installed the certificate ...
5
votes
2answers
256 views

How to build arbitrary Dockerfile Images Without Compromising Host

I'm building a server that will build images directly from Dockerfile: docker build -t arbitrarydocker . This docker file will be built on the same server as other client Dockerfiles, which may have ...
7
votes
1answer
827 views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
33
votes
2answers
32k views

Is it possible to escalate privileges and escaping from a Docker container?

I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc. I saw how easy is to get root in a docker host machine once you entered to the ...
1
vote
0answers
263 views

Lets Encrypt + Cert Bot: Setting up known Certificate Authority

I have a setup in docker where I have LetsEncrypt ACME Boulder + CertBot + DNSMASQ as a DNS Server. Additionally I have a client and a service where the service is served over https only. I had ...
2
votes
1answer
193 views

Containerization vs. Chroot in shared hosting

Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
2
votes
2answers
599 views

How to integrate client certificates for upstream servers with nginx as reverse proxy?

For my private VPS, I am building a configuration for different web applications (Owncloud,...) which depends on a combination of different Docker containers. At the front, I would like to use an ...
12
votes
1answer
2k views

How secure is docker container-to-container traffic?

I'm working on building a web application using the microservice architecture pattern in a set of docker containers and I'm wondering about the importance of securing the communication between the ...
5
votes
1answer
361 views

How secure is LXD compared to Docker?

I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?