KHnidek: Created page with " = Docker Security = "It works on my computer." - A statement that is becoming less important with the advent and introduction of containerisation. This is one of the main reasons for the massive upswing in container technologies == 1. Virtualization Techniques == * '''Container-Based''': Efficient, lightweight solutions using OS isolation. * '''Hypervisor-Based''': Strong isola..."

2024-01-07T09:43:15Z

Created page with " = Docker Security = "It works on my computer." - A statement that is becoming less important with the advent and introduction of containerisation. This is one of the main reasons for the massive upswing in container technologies == 1. Virtualization Techniques == * '''Container-Based''': Efficient, lightweight solutions using OS isolation. * '''Hypervisor-Based''': Strong isola..."

New page

= Docker Security =

"It works on my computer." - A statement that is becoming less important with the advent and introduction of containerisation.
This is one of the main reasons for the massive upswing in container technologies


== 1. Virtualization Techniques ==

* '''Container-Based''': Efficient, lightweight solutions using OS isolation.
* '''Hypervisor-Based''': Strong isolation with VMs, but more resource-intensive.


== 2. Docker Overview ==

* '''Client-Server Model'''
** '''Docker daemon''' (<code>dockerd</code>): Manages containers, images, networks.
** '''Docker client''' (<code>docker run/pull</code>): User interface for Docker.
** '''Docker registries''' (<code>docker push/pull</code>): Repositories for Docker images.


== 3. Docker Commands & Security Implications ==

* '''User Group Modification''': <code>sudo usermod -aG docker [user]</code>
** Grants Docker group access.
* '''Mounting Host Filesystem''': <code>docker run -v /:/privesc -it [image] /bin/bash</code>
** Poses a security risk.
* '''Altering Sudoers''': <code>echo “[user] ALL=(ALL) NOPASSWD: ALL” >> /privesc/etc/sudoers</code>
** Affects host’s security.


== 4. Security Threats and Practices ==

* '''Basic Commands for Monitoring and Cleanup''':
** List all containers: <code>docker ps -a</code>
** Inspect a container: <code>docker inspect [id]</code>
** Remove a container: <code>docker rm [id]</code>
* '''Prevention Techniques''':
** Run as non-root: <code>docker run --name [app] -u [user]</code>
** Read-only volumes: <code>docker run -v /:/privesc:ro -it debian /bin/bash</code>
** Limit resources: <code>docker run --cpus=0.5 --memory=128m</code>
** Network segregation: <code>docker network create, docker network rm</code>
** Secure Dockerfile practices: Audit with <code>grep</code>.
** Image inspection: <code>docker image inspect</code>, <code>docker image history</code>


== References ==

* Bui, Thanh. “Analysis of Docker Security.” ''ArXiv'', 2015. [https://api.semanticscholar.org/CorpusID:14908430 Link]
* Polop, Carlos. “Docker Breakout/Privilege Escalation.” [https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation Link]. Accessed 19-10-2023.
* Docker Inc. “Docker Overview | Docker Docs.” [https://docs.docker.com/get-started/overview/ Link]. Accessed 7-09-2023.
* Segura, Thomas. “Docker Security Best Practices.” [https://blog.gitguardian.com/how-to-improve-your-docker-containers-security-cheat-sheet/ Link]. Accessed 3-10-2023.

[[Category:Documentation]]

Docker Security - Revision history