Questions tagged [docker]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
290
votes
9answers
43k views

What makes Docker more secure than VMs or bare metal?

I recently had a discussion with a Docker expert about the security of Docker vs. virtual machines. When I told that I've read from different sources that it's easier for code running within a Docker ...
54
votes
8answers
14k views

Is it safe to trust a Docker container?

When it comes to Docker, it is very convenient to use a third party container that already exist to do what we want. The problem is that those containers can be very complicated and have a large ...
47
votes
1answer
9k views

How to mitigate Meltdown in Docker images?

On https://meltdownattack.com/ it is suggested that (in some cases?) scenarios with Docker containers are also vulnerable. I'm a developer using Docker for two different purposes: Images used for ...
40
votes
3answers
19k views

Docker as a sandbox for untrusted code

I have created a web application that among other things allows users to write, compile and execute code (Java, C#). The application creates a Docker container for every user where compilation and ...
34
votes
4answers
14k views

Passing secret keys securely to docker containers

I want to pass a secret value needed by an app that runs in a Docker container. This particular container is short-lived -- it starts up, runs a command, and then terminates. Method 1: Pass the ...
33
votes
2answers
33k views

Is it possible to escalate privileges and escaping from a Docker container?

I'm learning a lot about docker. I'm practicing creating docker clusters using docker-swarm, registry, shipyard, etc. I saw how easy is to get root in a docker host machine once you entered to the ...
23
votes
2answers
15k views

How to securely provide SSL certs to a Docker app

What is the most secure way to provide SSL certificates (for HTTPS) to a Docker application? The approaches I've considered: The environment It's common (but obviously not required) to use the ...
17
votes
3answers
1k views

Would CVE-2016-0728 affect Docker?

I ended up having a discussion about Docker and system security today and we came to the point where we asked ourselves of the latest CVE-2016-0728 exploit (privilege escalation) would affect Docker ...
17
votes
2answers
2k views

Securing Docker and LXC

The concept put forward by Docker and LXC seems to be, from a security perspective, a move in the right direction. Afraid of a MySQL zero-day? Run it in a Docker container and it won't be able to ...
16
votes
1answer
8k views

Can a root user inside a Docker/LXC break the security of the whole system?

My question is probably more about the LXC than about Docker, but I wonder what are the security mechanisms to prevent a root user inside a Docker image to access the whole host. More precisely, I ...
14
votes
1answer
6k views

Hardening/reducing attack surface for a Docker container

I'd like to set up a hardened Docker instance, mostly for running micro-services such as statically compiled golang applications. What I'm looking for is to protect the host OS from a rogue container ...
12
votes
1answer
2k views

How secure is docker container-to-container traffic?

I'm working on building a web application using the microservice architecture pattern in a set of docker containers and I'm wondering about the importance of securing the communication between the ...
11
votes
3answers
6k views

Risks posed by docker daemon running as root

My team has been getting pretty excited about using docker because it promises to simplify our deployments and provide a number of other design and operational benefits. We recently started to really ...
11
votes
1answer
181 views

Does running random “docker pull” essentially mean I'm giving someone root access?

I just noticed I'm rather eager to test projects that have a Docker container bundled with them. I do realize that setting a sudoers exception for the "docker" command basically means giving root ...
10
votes
3answers
931 views

Can network traffic between Docker containers be sniffed?

On normal networks, it is a security risk to send plaintext data, since attackers can sniff or even manipulate all traffic. Encryption is required for secure communication. When using Docker ...
9
votes
1answer
12k views

Docker runs container processes as root - should I be worried?

I am running a (QNAP) NAS with Docker functionality ("containerstation"). I thought it would be a lot safer to install apps via containers instead of apps from the store (or 3rd party stores). Many ...
8
votes
2answers
695 views

Does Docker provide the same security as a vm [duplicate]

Does Docker provide the same level of security/isolation as a virtual machine running over a hypervisor? If not, how can that be achieved?
8
votes
1answer
1k views

What are the potential security problems running untrusted code in a Docker container as a non-root user?

I've seen plenty of ink spilled by now about how Docker is not sufficiently isolated to allow arbitrary containers to be run in a multi-tenant environment, and that makes sense. "If it's root in ...
8
votes
2answers
3k views

Docker containers, environment variables, and databases

Environment variables (set with -e) in Docker containers are available to every linked container. Consider a typical use case, a database. The official MySQL image gives this example command: docker ...
7
votes
2answers
3k views

Docker: when to use apparmor vs seccomp vs --cap-drop

Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container. However I couldn't find any documentation or guideline on when to use which ...
7
votes
1answer
873 views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
7
votes
3answers
3k views

Can I make my online server more secure using Docker?

I had my online web server ransacked, they got in through my hosted WordPress site and privilege escalated from there. I am wondering, if I put the WordPress in a Docker, would that go a decent way ...
7
votes
1answer
420 views

What's the risk from enabling ptrace in docker?

Solutions for various problems (e.g., here and here) suggest enabling SYS_PTRACE when running a container that, say, needs to run a debugger or a fuzzer. Given that the capability isn't enabled by ...
6
votes
1answer
604 views

How to execute a command directly on the host system through docker.sock in a Docker container?

I've been studying Docker security and examining ways of escaping from container to host. Suppose Docker sock (docker.sock) is mounted into the container at /var/run/docker.sock, so that Docker ...
6
votes
2answers
7k views

Docker port forwarding exposure

I try docker with a simple webapp : docker run -d -v $(pwd):/app -p 8080:80 image_name I have docker listen on 8080: tcp6 0 0 :::8080 :::* LISTEN 13304/docker ...
6
votes
2answers
3k views

Where to find the security hardened docker images

Is there any service that provides certified, security hardened Docker images for common platforms like Python, PHP, Node, Java, etc. with 0 major/critical CVEs. Currently, we are using the ones from ...
6
votes
3answers
924 views

Disable ASLR inside Docker container

I am looking to disable ASLR (address space layout randomization) inside a Docker container. Not sure if it is possible. The container is running on Alpine, but from what I understand, ASLR is a ...
6
votes
2answers
4k views

How to securely store secrets in Docker container?

The application I'm working on has more than a dozen of secrets, SSL certificates and API keys. Currently I have a file that's added into .gitignore and it contains all my secrets. How to securely ...
5
votes
5answers
1k views

Should I remove bash from my Docker web app container?

Suppose I am a dev and want to harden my web application environment. If my application does not make use of binaries like sh, ls, find, echo etc. should I just remove them from my image?
5
votes
1answer
4k views

Is adding docker group not a good idea?

Question Is creating a docker group could be a bad idea from security perspectives? I saw stack exchange answers which tells to create docker group to avoid issues of needing root permission or sudo....
5
votes
1answer
1k views

strategy for dealing with glibc issues through all docker containers

CVE-2015-7547 affects glibc, which is present in pretty nearly all docker containers. There's an automated process underway which will update all official containers, but it's not immediately clear ...
5
votes
1answer
363 views

How secure is LXD compared to Docker?

I was thinking on using LXD instead of Docker, but I can't find anything about how secure it is compared to a regular or a CIS hardened Docker. Any information about this?
5
votes
1answer
264 views

Why do broken symlinks pose a security threat?

I have been given a security specification document that contains some rules about the product I currently work on (docker containers). One states that: All broken symlinks must be removed. My ...
5
votes
2answers
257 views

How to build arbitrary Dockerfile Images Without Compromising Host

I'm building a server that will build images directly from Dockerfile: docker build -t arbitrarydocker . This docker file will be built on the same server as other client Dockerfiles, which may have ...
5
votes
1answer
277 views

What are the security implications of capabilities in Kubernetes pods?

We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities: ...
5
votes
2answers
485 views

MongoDB/Debian server successfully attacked - reason for public ip to get to mongodb server?

I got a mongodb server which from the logfiles got a connection from a remote ip address, though its obviously not allowed (or to be more precise: the mongod is not bound to any public interface) due ...
4
votes
2answers
918 views

Is running wp-cli as root in docker container dangerous?

I'm deploying a web app that consists of 5 containers: MariaDB PHP-FPM nginx Data Only Container WP CLI When I try to run a WP CLI command, I get the following warning: Error: YIKES! It looks ...
4
votes
2answers
591 views

How to prevent a docker container from being attached by multiple users?

When you run docker containers you can list running containers by using docker ps Then you can attach them by docker attach <container id> The trouble is that all people that can attach the ...
4
votes
2answers
751 views

Attack vectors when running untrusted docker images

What are the possible attack vectors if I am running user-submitted docker image, e.g. pull via docker pull FOO; ... docker run FOO where FOO is a user-submitted string containing the name of a Docker ...
4
votes
1answer
3k views

Is Docker a PCI DSS compliant form of virtualization?

I'm thinking of the mass of "single function per server" virtual machines which really do nothing in terms of memory and CPU that a PCI DSS certification entails, the NTP server, central ...
4
votes
3answers
2k views

Docker X11 Forwarding Security

I am currently running a Docker container with a program with a GUI forwarded over SSH (using X forwarding over OpenSSH). The virtualized server has X11Forwarding enabled and I can connect to it from ...
4
votes
3answers
4k views

Do websockets represent a security problem to my local machine?

To work around a problem with IntelliJ, I have been recommended to configure my local Docker daemon to work on port 2375 without TLS authentication. I am concerned however that a malicious website ...
4
votes
1answer
580 views

Security implications of adding nobody to docker group

A docker monitoring tool needs read access to the docker socket in order to collect stats. The setup instructions asks me to provide "Read-only access to the Docker socket" by running the following ...
4
votes
1answer
75 views

Restrict compilation to certain machines

I am a software developer in a big company. I just realised that I could technically clone the repository of my employers git repository. The infrastructure is in docker images. So technically this ...
4
votes
2answers
348 views

How to securely run Puppeteer / Chromium in a Docker container?

Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing. The problem is that, from ...
4
votes
3answers
863 views

Managing trusted certificates revocation in containers in as “cloud native” means as possible

This is a bit of a tough question to ask so bear with me a bit. I'll try to be brief if I can. Problem statement I'm looking for a modern best practice for managing and deploying the trusted root CA ...
3
votes
2answers
567 views

Should the traffic between the containers need to be encrypted?

Should the traffic between two containers in same docker environment need to be encrypted ? Is it possible for a container to snoop into the un-encrypted traffic between two containers ?
3
votes
1answer
995 views

Running Docker container as Root user

Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear: Is it still the same kind of insecure even if the container cannot ...
3
votes
1answer
166 views

I'm seeing strange names in my list of docker containers, is someone having fun at docker or is that from hackers?

I'm trying to run a docker and it fails for various reasons. As I check my list of dockers (docker ps -a), I see those names: pedantic_gauss recursing_feynman adoring_brattain suspicious_tesla ...
3
votes
1answer
2k views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...