82
votes
Is RAM wiped before use in another LXC container?
This isn't how memory allocation in linux works, so your scenario is not right.
The linux kernel maintains a pool of free pages and quickly freeable pages (which includes cached disk blocks and ...
- 2,003
67
votes
Accepted
If a container is compromised does that mean host also compromised?
If the kernel is compromised in the container, the host is compromised.
Ostensibly, a compromised container should not be able to harm the host. However, container security is not great, and there are ...
- 66.7k
60
votes
Accepted
Is it possible to escalate privileges and escaping from a Docker container?
A user on a Docker host who has access to the docker group or privileges to sudo docker commands is effectively root (as you can do things like use docker to run a privilieged container or mount the ...
- 62.3k
20
votes
Accepted
Is RAM wiped before use in another LXC container?
Processes in LXC containers are normal processes as far as the Linux kernel is concerned. They are separated from most of the host's resources by using namespaces, which does not make them a special ...
- 4,901
17
votes
Accepted
How to execute a command directly on the host system through docker.sock in a Docker container?
The best way that I've found to execute commands on the underlying host with an exposed Docker socket is Ian Miell's most pointless docker command ever
The command looks like this :-
docker run -ti
...
- 62.3k
14
votes
Docker runs container processes as root - should I be worried?
I assume you are concerned about containerized applications running as root.
root in container is a risk. It still interacts with the kernel as root. And if an application manages to break out of ...
- 379
6
votes
Is it possible to escalate privileges and escaping from a Docker container?
With normal means, no. Docker was intentionally designed on this security concept.
It uses the namespace functionality of the kernel to separate the processes running in a container from the on host ...
- 3,023
6
votes
How to prevent a docker container from being attached by multiple users?
If a user on a Docker Engine host has rights to execute docker commands (via either having sudo privileges, or membership of the docker group) there is no way (with the base Docker product) of ...
- 62.3k
5
votes
If a container is compromised does that mean host also compromised?
Because containers are not as isolated as VMs, yes, in one way they are less secure. See forest's answer.
Having said that, I think it's worth noting that containers also provide some some benefits ...
- 3,049
5
votes
Security of untrusted Docker containers
There's a couple of different aspect to your question and different options for each. Using standard Docker tech, a container is just a process running on the host, with Linux features applied to ...
- 62.3k
4
votes
Accepted
Running Docker container as Root user
Answering your questions:
No is not the same. If you don't set on a container access to docker socket, that means the container will not be able to create, check, delete or other actions on host ...
- 5,285
4
votes
Accepted
What are the best practices for anti-virus / anti-malware when using containers?
The general insistence of some security standards on anti-malware software running on every host, without exception, is a bit... dubious in a lot of cases (IMO).
That said, if it's a standard you ...
- 62.3k
4
votes
Is RAM wiped before use in another LXC container?
Yes, if memory used by a process in one LXC container is later allocated to another process in another LXC container, the contents will definitely be wiped. This is the case for all processes and has ...
- 231
3
votes
Secure Communication between Swarm Worker Nodes
You are correct that it is only the management traffic that is encrypted by default.
There is an option with the overlay networks to enable IPSEC for application traffic, but it is not supported by ...
- 187
3
votes
Accepted
Is it normal to being able to kill a process from outside a container?
Yes it is. Docker processes on Linux are sandboxed such that they can't affect the rest of the system, but the rest of the system is free to mess with them however it wants to. They are still running ...
- 48.4k
3
votes
Docker secret security
If an attacker roots your container I would say that he is able to see what's inside the file, since according to the documentation, the file is mounted unencrypted on the container:
When you grant ...
- 237
3
votes
Docker secret security
Short answer: yes.
The Docker documentation says:
Secrets are encrypted during transit and at rest... Here
, which is exactly what it is supposed to be. And rest in this case means: While it is ...
- 2,064
3
votes
Accepted
Can malicious applications running inside a docker container still be harmful?
With Linux containers, the container shares the same kernel as the host. So any vulnerabilities in the host's kernel could be used to escape from the container as root. However, if you keep your ...
- 12.8k
3
votes
Accepted
What disadvantages running untrusted applications in anbox has over running them in a virtual machine?
If you intend to run malicious apps better keep using VMs
The main difference between virtualization and containerization is that, while a virtual machine is running a full independent Operating ...
- 454
3
votes
Accepted
Container Vulnerability Management
There isn’t really a good approach yet — not even from the vendors that say that they address this space. I have turned to the literature (e.g., learning.oreilly) which does mention JFrog but fails to ...
- 19.1k
2
votes
Accepted
Potential added risks of using Docker in production servers
Regarding the point of the good practices for Docker deployments, you can run the CIS Docker Benchmark which performs a set of automatic tests to guarantee that the CIS Docker Guidelines are compliant ...
- 345
2
votes
Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?
RFC 5084 solves the issue of using AES in GCM mode within a CMS message. And the CMC specified by RFC 5652 does not restrict you from using any public key algorithm.
- 34.2k
2
votes
Docker secret security
Salt the secret using your own technique, taking inputs from the docker metadata, the environment, arguments or environment variables, etc. then use md5 and docker inspect to gather the info needed to ...
2
votes
LXC vs. LXD: Which is “more secure”?
Turns out LXD is more secure than LXC by default: https://github.com/lxc/lxd/issues/2771
- 1,073
2
votes
Accepted
How secure is LXD compared to Docker?
Read this article: https://linuxhint.com/lxd-vs-docker/
It seems there is no other more secure than the other. Everything well configured has similar security level, but Docker seems more secure "by ...
- 5,285
2
votes
Secure browsing on any device without limiting the browser
You are ok with the endpoints getting infected, but you don't want the infections to spread. This has been done before in a variety of ways.
Network segmentation:
personal devices (uncontrolled ...
- 129k
2
votes
Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
Systemd-nspawn only manages isolated processes. It cannot isolate resources (which systemd can).
As a constructive difference, in the case of namespaces, you start with no isolation and you add ...
- 8,899
2
votes
Accepted
How to prevent a docker container from being attached by multiple users?
Docker Sub commands using sudo
One solution is to provide them with selected docker commands using sudo and do not provide the docker attach, or docker run command.
You can restrict them to run ...
- 1,612
2
votes
Accepted
Containerization vs. Chroot in shared hosting
First, chroot is not a security feature in any Unix systems. A privileged user can perform a second chroot to break out. See here
In a docker environment, processes and network are isolated so can't ...
- 136
2
votes
Accepted
Is uncompromisable obfuscated x86-64 execution possible?
No, nothing that is secure anyway.
Currently available systems are standard methods of making sure an app can't be run without a license. However these can be reverse engineered relatively easily.
...
- 236
Only top scored, non community-wiki answers of a minimum length are eligible