a complete filesystem that contains everything it needs to run: code, runPme, system tools, system libraries – anything you can install on a server. This guarantees that it will always run the same, regardless of the environment it is running in.”
model? 2. How do I ensure I can trust the code running in my containers? 3. How do I know if I’ve configured my Docker host + containers in a way that minimizes my risk? 4. How do containers change my security pracPces, e.g. monitoring? questions for the security professional
for a given container, tell me who/what I am trusPng build from a trusted base image be aware of who you are trusPng don’t overrely on Docker hub tooling to apply and validate security updates
locally, and download and verify images manually before imporPng them into Docker using docker load.” • hcps:/ /Ptanous.com/posts/docker-‐insecurity#fn:4 • Use a private docker registry • hcps:/ /www.digitalocean.com/community/tutorials/how-‐to-‐set-‐up-‐a-‐private-‐docker-‐registry-‐ on-‐ubuntu-‐14-‐04 , hcps:/ /quay.io • Use RedHat cerPfied containers • hcp:/ /www.redhat.com/en/about/press-‐releases/red-‐hat-‐announces-‐cerPficaPon-‐for-‐ containerized-‐applicaPons-‐extends-‐customer-‐confidence-‐and-‐trust-‐to-‐the-‐cloud
for Docker images! • e.g., scan images, validate installed libraries and binaries do not have criPcal security issues and align with signed package manifests. • hcps:/ /github.com/banyanops/collector +`cruM’ but for containers? • hcps:/ /github.com/OpenSCAP/container-‐compliance -‐ RHEL only • contribute to the packaging/distribuPon trust conversaPon! • hcps:/ /github.com/docker/distribuPon/pull/179 • references: hcp:/ /theupdateframework.com/
prevent one container from sucking all of the resources (DoS) another container on the same host • $ docker run -it --rm -m 128m fedora bash • hcps:/ /goldmann.pl/blog/2014/09/11/resource-‐management-‐in-‐docker/
id=0 processes as root! • seccomp filtering to permit or block individual system calls (soon!) • hcp:/ /opensource.com/business/15/3/docker-‐security-‐future coming soon
2. Load it into app armor: cat my_container_profile | sudo apparmor_parser -‐r 3. ` 4. Run it with your docker container: docker run — security-‐opt=“apparmor:my_container_profile” 5. $$$ Profit?
(and turned off when you docker run — privileged=true) • be careful: when you supply your own apparmor profile, your are essenPally resetng the capabiliPes. • copy or inherit these when you create a new profile for your containers. this looks familiar…
your go-‐to trusted distribuPon source for applicaPons.… • Why not • Have a registry for apparmor and SELinux profiles geared for official dockerized app containers? • …Include seccomp filters and other security configs? • Share your polices & reduce the burden of having to harden your own apps/containers.
docker security-‐profile fetch wordpress:latest # you can even fetch by image / tag docker security-‐profile fetch 0cc6ffbf1a0cd78ab244c4b3b5cef13618bf4c8bcd229ec2673 1a951c33df72e # allow users to submit/push their own app armor profiles docker security-‐profile push —-‐profile=“apparmor:/ etc/apparmor/wordpress.profile” jandre/ wordpress:custom
hardening, tesPng, and monitoring • InnovaPon here should come not just from the Docker folks. • The consistency of Docker containers enables us to be innovaPve in how we automate the above ^^