5 security concerns when using Docker
Five things to keep in mind when considering using Docker for your mission-critical applications.
Reading online posts and news items1 about Docker can give you the impression that Docker is inherently insecure and not ready for production use. While you certainly need to be aware of issues related to using containers safely, containers, if used properly, can provide a more secure and efficient system than using virtual machines (VMs) or bare metal alone.
To use Docker safely, you need to be aware of the potential security issues and the major tools and techniques for securing container-based systems.
You also need to keep five things in mind when considering using Docker for your mission-critical applications.
Kernel exploits
Unlike in a VM, the kernel is shared among all containers and the host, magnifying the importance of any vulnerabilities present in the kernel. Should a container cause a kernel panic, it will take down the whole host. In VMs, the situation is much better: an attacker would have to route an attack through both the VM kernel and the hypervisor before being able to touch the host kernel.
Denial-of-service attacks
All containers share kernel resources. If one container can monopolize access to certain resources–including memory and more esoteric resources such as user IDs (UIDs)—it can starve out other containers on the host, resulting in a denial-of-service (DoS), whereby legitimate users are unable to access part or all of the system.
Container breakouts
An attacker who gains access to a container should not be able to gain access to other containers or the host. By default, users are not namespaced, so any process that breaks out of the container will have the same privileges on the host as it did in the container; if you were root
in the container, you will be root
on the host.2 This also means that you need to worry about potential privilege escalation attacks–whereby a user gains elevated privileges such as those of the root
user, often through a bug in application code that needs to run with extra privileges. Given that container technology is still in its infancy, you should organize your security around the assumption that container breakouts are unlikely, but possible.
Poisoned images
How do you know that the images you are using are safe, haven't been tampered with, and come from where they claim to come from? If an attacker can trick you into running his image, both the host and your data are at risk. Similarly, you want to be sure that the images you are running are up-to-date and do not contain versions of software with known vulnerabilities.
Compromising secrets
When a container accesses a database or service, it will likely require a secret, such as an API key or username and password. An attacker who can get access to this secret will also have access to the service. This problem becomes more acute in a microservice architecture in which containers are constantly stopping and starting, as compared to an architecture with small numbers of long-lived VMs. This report doesn't cover how to address this, but see the Deployment chapter of Using Docker (O'Reilly, 2015) for how to handle secrets in Docker.
The above list is not comprehensive, but should serve as food for thought. If you want to read more about how to address these concerns, check out Docker Security by Adrian Mouat (free login required).
-
I strongly recommend Dan Walsh’s series of posts at opensource.com.↩
-
It is possible to turn on user namespacing, which will map the root user in a container to a high-numbered user on the host. We will discuss this feature and its drawbacks later.↩
(oreilly)
More:
- 10 Top Video Sharing Scripts
- How to use social media to create business value?
- AOL SMTP configuration
- Manual Traffic Exchange Services
- What Is Blockchain in 6 Awesome Infographics
- 20 Open Source Ecommerce Platforms
- BlackBerry Reports First Quarter Fiscal 2014 Results
- Using IoT and Fleet Management
- Bitcoins and Blockchain – What Are They?
- 50 Top Open Source Marketing Applications
- How to Install ADB on Windows, macOS, and Linux, Install ROM Gretel A7
- Hotmail SMTP configuration
DVMS is a software company that specializes in consulting and application development, solutions on mobile devices.
- Have experience in providing high quality IT services to individuals and businesses in Viet Nam and many countries around the world.
- Apply strict quality control process and listens to customer feedback to improve service quality.
- Good experience in large and complex projects.
- We have a large team of engineers, mastering many software engineering, network and telecommunications ...
Our mobile & tablet application development services