Hot answers tagged

460 votes
Accepted

What makes Docker more secure than VMs or bare metal?

No, Docker containers are not more secure than a VM. Quoting Daniel Shapira: In 2017 alone, 434 linux kernel exploits were found, and as you have seen in this post, kernel exploits can be ...
  • 51.7k
85 votes
Accepted

How to mitigate Meltdown in Docker images?

The patch against Meltdown is kernel only. Docker containers run within the kernel of the host system. This means the resistance against Meltdown depends on the host kernel only. In other words: you ...
83 votes

What makes Docker more secure than VMs or bare metal?

Saying either a VM or Docker is more secure than the other is a massive over simplification. VM provides hardware virtualization; the hypervisor emulates hardware so that the guest kernel thinks it ...
  • 31.3k
59 votes
Accepted

Is it possible to escalate privileges and escaping from a Docker container?

A user on a Docker host who has access to the docker group or privileges to sudo docker commands is effectively root (as you can do things like use docker to run a privilieged container or mount the ...
  • 61.4k
43 votes
Accepted

Docker as a sandbox for untrusted code

tl;dr: container solutions do not and never will do guarantee to provide complete isolation, use virtualization instead if you require this. Bottom up and top down approaches Docker (and the same ...
  • 23.7k
39 votes
Accepted

Is it safe to trust a Docker container?

At the moment there is no way to easily work out whether to trust specific docker containers. There are base containers provided by Docker and OS providers which they call "trusted" but the software ...
  • 61.4k
28 votes

Docker: when to use apparmor vs seccomp vs --cap-drop

You can use all of them. Each of these security features have different purposes, and there is actually little overlap. They all function to reduce the damage that a process can cause once it has been ...
  • 65.4k
24 votes

What makes Docker more secure than VMs or bare metal?

As you correctly stated, Docker uses "Operating-system-level virtualization". You can think of this (if you are a *nix fan) as a fancy form of chroot. By harnessing features and functionality built ...
  • 3,062
21 votes
Accepted

Can a root user inside a Docker/LXC break the security of the whole system?

Short answer: Root on the docker container can break out of jail and compromise system. Docker is meant to simplify the life of developers and sysadmins, not about containing programs isolated from ...
  • 51.7k
16 votes

Docker as a sandbox for untrusted code

Whilst the answer from @jens-erat has the correct high-level point that virtualization provides superior isolation to containerization solutions like docker, it is not a black and white setup. On the ...
  • 61.4k
15 votes
Accepted

Would CVE-2016-0728 affect Docker?

This is not a privilege escalation where code gets "only" executed as a higher privileged user. This issue is about execution of code inside the Linux kernel, i.e. the kernel which gets shared between ...
14 votes

What makes Docker more secure than VMs or bare metal?

I agree with ThoriumBR's answer if we're just comparing a blank VM with a blank Docker container. It should be noted, however, that properly configuring your system such as in Red Hat's Atomic Host ...
14 votes
Accepted

How to execute a command directly on the host system through docker.sock in a Docker container?

The best way that I've found to execute commands on the underlying host with an exposed Docker socket is Ian Miell's most pointless docker command ever The command looks like this :- docker run -ti ...
  • 61.4k
14 votes
Accepted

Security implications of granting non-root access to privileged ports (<1024)

When you're using rootless Docker/Podman, the risks of allowing users to bind ports < 1024, generally depend on what else is happening on the system. TBH the old restriction on low ports doesn't ...
  • 61.4k
13 votes

What makes Docker more secure than VMs or bare metal?

Docker Containers are Not Inherently “More Secure” But the Ability to Quickly Spin Up—and Destroy—Duplicates in a Cluster Is Very Useful from a Security Standpoint. Okay, lots of other answers here ...
  • 1,184
13 votes

Docker runs container processes as root - should I be worried?

I assume you are concerned about containerized applications running as root. root in container is a risk. It still interacts with the kernel as root. And if an application manages to break out of ...
  • 369
12 votes

Security implications of granting non-root access to privileged ports (<1024)

It depends on your system. If it's a multi-user system with multiple users able to run docker, you may fall victim to a race attack, where a malicious docker container is started when your legitimate ...
  • 14.7k
11 votes

Does Docker provide the same security as a vm

Theoretically, the isolation of Docker is not quite as strong, because parts of the system are shared (kernel is shared, container has a chroot of the original filesystem, etc). However, for most ...
  • 315
10 votes
Accepted

Is adding docker group not a good idea?

The documentation (especially the Manage Docker as a non-root user part of Post-installation steps for Linux) is really clear on this: Warning: The docker group grants privileges equivalent to the ...
  • 214
10 votes
Accepted

I'm seeing strange names in my list of docker containers, is someone having fun at docker or is that from hackers?

As mentioned in comments this is part of Docker's innate functionality, and is designed to make it easier to work with containers. The canonical identifier for a Docker container is a SHA-256 hash, ...
  • 61.4k
10 votes
Accepted

/opt and sudo unzip to /opt, is it safe?

Yes, it is safer to run unzip without root permissions and then move the extracted contents to their final destination. However, if you suspect that the file which you are providing to unzip is ...
  • 65.4k
9 votes
Accepted

How to securely provide SSL certs to a Docker app

One challenge with the environment variable approach is that they are shared with any linked containers (more info here), which may restrict the use of that approach in some setups. Private images as ...
  • 61.4k
9 votes
Accepted

Hardening/reducing attack surface for a Docker container

I'd refer you to the CIS Benchmarks for hardening guidelines. The current CIS Benchmark for Docker can be found here. These are an accepted industry standard for baseline hardening. They also offer ...
  • 5,135
9 votes
Accepted

Security risks of using ffmpeg as part of web service

Yes there are security risks, especially if you allow arbitrary formats. FFmpeg supports a huge variety of formats, both popular and obscure, for video, audio, and images. Any vulnerability in ...
  • 65.4k
8 votes

Is it safe to trust a Docker container?

Trust it as much as any unsigned code that you run on your systems. Containers are just processes with some extra namespace protections on them, so that's all the protections they get. They still ...
  • 2,518
8 votes
Accepted

Is Docker a PCI DSS compliant form of virtualization?

A self-answer after a convo on the #docker IRC, PCI DSS v3.2 doesn't state anything about the kind of virtualization that is required, nothing states you should use hardware instead of OS-level ...
  • 503
8 votes

What makes Docker more secure than VMs or bare metal?

The question is too broad to be answered by a simple "yes" or "no". There are very clear and open attack surfaces for Docker containers: If the attacker is the one who can start containers (i.e., ...
  • 2,369
7 votes

Is it safe to trust a Docker container?

It's best to consider a Docker container to be the same as running an application on the host system. There are some attempts to lock down the Docker daemon by removing Linux Kernel capabilities, but ...
7 votes

How to securely provide SSL certs to a Docker app

If anyone comes across this topic, note that a more recent solution might be to use Docker secrets: https://docs.docker.com/engine/swarm/secrets/ It enables Docker Swarm services to safely transmit ...
7 votes

How secure is docker container-to-container traffic?

From the docker documentation on container linking, it's possible to see that the standard setup for links is to create an internal network on the docker host which is used by the containers to talk ...
  • 61.4k

Only top scored, non community-wiki answers of a minimum length are eligible