Practical
Docker Security
Hack.lu - Thursday 18 October 2018
Overview
And bunch of other stuffs!
PID Namespace
PID Namespace
PID Namespace
PID Namespace
PID Namespace
Resource groups
Stress it! (1/2)
Stress it! (2/2)
But there’s way moar
You can limit :
Link: https://docs.docker.com/config/containers/resource_constraints/
PID Limits
:(){ :|: & };:
Fork bomb!
User Namespaces
User namespaces 101
Mounting volumes 101
Mounting volumes + user remapping
Dockerd + namespace remapping
Container Policies
Mounting volume in read-only (:ro)
Seccomp profiles
+/- ~ “Firewall for syscalls”
Checking if seccomp is active?
Container + Seccomp
syscalls.drop(chmod)
“Unconfined” = worst ennemy
Strace to the win!
Finding which syscalls are used for a cmd
Root capabilities
Capabilities 101
User remap + adding new capabilities ?
Block all and add only what’s necessary
Checking capabilities from container
Checking capabilities from container
Note: Not working since the capabilities are set to one binary
Checking capabilities from host machine
Network segmentation
Practical example
Interface 1
Container no 1
Container no 2
Container no 3
Interface 2
Creating all the networks and...
… plugging!
Practical example
Interface 1
Container no 1
Container no 2
Container no 3
Interface 2
172.19.0.2
172.19.0.3
172.20.0.2
172.20.0.3
Docker auditing
Docker Bench Security
Image Security Scanning with Clair
Protect the Docker daemon socket
Docker socket exposed (1/2)
Docker socket exposed (2/2)
Docker Security “Checklist”
�- Use minimal and certified images (alpine, even after this =/)�- Use images pulled with content trust (BlackDuck, Artifactory, DTR, …)�- Scan images nightly with Clair-scanner + reporting �- Check your host implementation with Docker CIS�- Push to your consumers with content trust (Artifactory, ...)�- Analyse results from Docker Security Scanning�- TLS encrypt everything! (think auth through certificate)�- Read-only volumes + containers if possible (container policies)�- Separate networks whenever possible�- Drop root privileges / unused system calls (seccomp)