Skip to main content
Share Your Experience: Take the 2024 Developer Survey
82 votes

Is RAM wiped before use in another LXC container?

This isn't how memory allocation in linux works, so your scenario is not right. The linux kernel maintains a pool of free pages and quickly freeable pages (which includes cached disk blocks and ...
user10489's user avatar
  • 2,043
67 votes
Accepted

If a container is compromised does that mean host also compromised?

If the kernel is compromised in the container, the host is compromised. Ostensibly, a compromised container should not be able to harm the host. However, container security is not great, and there are ...
forest's user avatar
  • 66.8k
60 votes
Accepted

Is it possible to escalate privileges and escaping from a Docker container?

A user on a Docker host who has access to the docker group or privileges to sudo docker commands is effectively root (as you can do things like use docker to run a privilieged container or mount the ...
Rory McCune's user avatar
  • 62.3k
20 votes
Accepted

Is RAM wiped before use in another LXC container?

Processes in LXC containers are normal processes as far as the Linux kernel is concerned. They are separated from most of the host's resources by using namespaces, which does not make them a special ...
Quitting Due To Antisemitism's user avatar
17 votes
Accepted

How to execute a command directly on the host system through docker.sock in a Docker container?

The best way that I've found to execute commands on the underlying host with an exposed Docker socket is Ian Miell's most pointless docker command ever The command looks like this :- docker run -ti ...
Rory McCune's user avatar
  • 62.3k
14 votes

Docker runs container processes as root - should I be worried?

I assume you are concerned about containerized applications running as root. root in container is a risk. It still interacts with the kernel as root. And if an application manages to break out of ...
mviereck's user avatar
  • 389
6 votes

Is it possible to escalate privileges and escaping from a Docker container?

With normal means, no. Docker was intentionally designed on this security concept. It uses the namespace functionality of the kernel to separate the processes running in a container from the on host ...
peterh's user avatar
  • 3,030
6 votes

How to prevent a docker container from being attached by multiple users?

If a user on a Docker Engine host has rights to execute docker commands (via either having sudo privileges, or membership of the docker group) there is no way (with the base Docker product) of ...
Rory McCune's user avatar
  • 62.3k
5 votes

If a container is compromised does that mean host also compromised?

Because containers are not as isolated as VMs, yes, in one way they are less secure. See forest's answer. Having said that, I think it's worth noting that containers also provide some some benefits ...
JimmyJames's user avatar
  • 3,049
5 votes

Security of untrusted Docker containers

There's a couple of different aspect to your question and different options for each. Using standard Docker tech, a container is just a process running on the host, with Linux features applied to ...
Rory McCune's user avatar
  • 62.3k
4 votes
Accepted

Running Docker container as Root user

Answering your questions: No is not the same. If you don't set on a container access to docker socket, that means the container will not be able to create, check, delete or other actions on host ...
OscarAkaElvis's user avatar
4 votes
Accepted

What are the best practices for anti-virus / anti-malware when using containers?

The general insistence of some security standards on anti-malware software running on every host, without exception, is a bit... dubious in a lot of cases (IMO). That said, if it's a standard you ...
Rory McCune's user avatar
  • 62.3k
4 votes

Is RAM wiped before use in another LXC container?

Yes, if memory used by a process in one LXC container is later allocated to another process in another LXC container, the contents will definitely be wiped. This is the case for all processes and has ...
Alex D's user avatar
  • 231
3 votes

Secure Communication between Swarm Worker Nodes

You are correct that it is only the management traffic that is encrypted by default. There is an option with the overlay networks to enable IPSEC for application traffic, but it is not supported by ...
Jack's user avatar
  • 187
3 votes
Accepted

Is it normal to being able to kill a process from outside a container?

Yes it is. Docker processes on Linux are sandboxed such that they can't affect the rest of the system, but the rest of the system is free to mess with them however it wants to. They are still running ...
CBHacking's user avatar
  • 49.1k
3 votes

Docker secret security

If an attacker roots your container I would say that he is able to see what's inside the file, since according to the documentation, the file is mounted unencrypted on the container: When you grant ...
tehmoon's user avatar
  • 237
3 votes

Docker secret security

Short answer: yes. The Docker documentation says: Secrets are encrypted during transit and at rest... Here , which is exactly what it is supposed to be. And rest in this case means: While it is ...
Ben's user avatar
  • 2,064
3 votes
Accepted

Can malicious applications running inside a docker container still be harmful?

With Linux containers, the container shares the same kernel as the host. So any vulnerabilities in the host's kernel could be used to escape from the container as root. However, if you keep your ...
multithr3at3d's user avatar
3 votes
Accepted

What disadvantages running untrusted applications in anbox has over running them in a virtual machine?

If you intend to run malicious apps better keep using VMs The main difference between virtualization and containerization is that, while a virtual machine is running a full independent Operating ...
Albert Gomà's user avatar
3 votes
Accepted

Container Vulnerability Management

There isn’t really a good approach yet — not even from the vendors that say that they address this space. I have turned to the literature (e.g., learning.oreilly) which does mention JFrog but fails to ...
atdre's user avatar
  • 19.1k
2 votes
Accepted

Potential added risks of using Docker in production servers

Regarding the point of the good practices for Docker deployments, you can run the CIS Docker Benchmark which performs a set of automatic tests to guarantee that the CIS Docker Guidelines are compliant ...
b0rt's user avatar
  • 345
2 votes

Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?

RFC 5084 solves the issue of using AES in GCM mode within a CMS message. And the CMC specified by RFC 5652 does not restrict you from using any public key algorithm.
John Deters's user avatar
  • 34.2k
2 votes

Docker secret security

Salt the secret using your own technique, taking inputs from the docker metadata, the environment, arguments or environment variables, etc. then use md5 and docker inspect to gather the info needed to ...
datocrats.org's user avatar
2 votes

LXC vs. LXD: Which is “more secure”?

Turns out LXD is more secure than LXC by default: https://github.com/lxc/lxd/issues/2771
Florian Schneider's user avatar
2 votes
Accepted

How secure is LXD compared to Docker?

Read this article: https://linuxhint.com/lxd-vs-docker/ It seems there is no other more secure than the other. Everything well configured has similar security level, but Docker seems more secure "by ...
OscarAkaElvis's user avatar
2 votes

Secure browsing on any device without limiting the browser

You are ok with the endpoints getting infected, but you don't want the infections to spread. This has been done before in a variety of ways. Network segmentation: personal devices (uncontrolled ...
schroeder's user avatar
  • 131k
2 votes

Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

Systemd-nspawn only manages isolated processes. It cannot isolate resources (which systemd can). As a constructive difference, in the case of namespaces, you start with no isolation and you add ...
Overmind's user avatar
  • 8,899
2 votes
Accepted

How to prevent a docker container from being attached by multiple users?

Docker Sub commands using sudo One solution is to provide them with selected docker commands using sudo and do not provide the docker attach, or docker run command. You can restrict them to run ...
Ijaz Ahmad's user avatar
  • 1,612
2 votes
Accepted

Containerization vs. Chroot in shared hosting

First, chroot is not a security feature in any Unix systems. A privileged user can perform a second chroot to break out. See here In a docker environment, processes and network are isolated so can't ...
Celebre Asm's user avatar
2 votes
Accepted

Is uncompromisable obfuscated x86-64 execution possible?

No, nothing that is secure anyway. Currently available systems are standard methods of making sure an app can't be run without a license. However these can be reverse engineered relatively easily. ...
Nic's user avatar
  • 236

Only top scored, non community-wiki answers of a minimum length are eligible