If it’s in a container it’s secure right ?
A guide to container security by @scottcoulton
Slide 2
Slide 2 text
About me.
Platform
engineering lead @
Slide 3
Slide 3 text
Does the traditional infosec
toolchain work efficiently
in a world where a
container’s average lifespan is
2 days?
Slide 4
Slide 4 text
1. Intro
What we will cover
➔ How is container security
different ?
Does traditional security fit ?
➔ How to protect our container
Protecting from the inside out
➔ Security and CD
Can the 2 worlds live together
➔ Live demo
Slide 5
Slide 5 text
The way that traditional
infosec works is
Reactive
Containers allow you to be
Proactive in your
approach to infosec
Slide 6
Slide 6 text
2. Examples
Here are a few comparable examples:
➔ Traditional
Nessus, AV, HIDS
➔ New school
AppArmor, Clair, Notary
Slide 7
Slide 7 text
The risks.
● DoS the host (CPU, Memory or Disk)
● Fork Bomb
● Kernel modification
● Privilege Escalation
Slide 8
Slide 8 text
Let’s look @ protecting the
engine.
Docker 1.12 Benchmark
Slide 9
Slide 9 text
Some sane defaults.
● Don’t run --pid host or --net host (without knowing the
risks)
● Don’t bind your daemon to tcp://0.0.0.0:4243
● Don’t use aufs as your storage driver
● Use TLS for all daemon traffic
Slide 10
Slide 10 text
Just one! That’s all you need.
(I am talking about process inside your container !!!)
Slide 11
Slide 11 text
If you know the process then
apply AppArmor.
Slide 12
Slide 12 text
AppArmor example.
Slide 13
Slide 13 text
Infosec and continuous delivery.
The myth ...
Slide 14
Slide 14 text
Add security to the pipeline
Enter
Slide 15
Slide 15 text
Sign our images
with Notary.
Slide 16
Slide 16 text
The full continuous delivery pipeline.
Slide 17
Slide 17 text
3. Live Demo
We are going to test what we have learnt
today and run a standard Nginx image
We will them use the Dirtyc0w vulnerability to
write to a file owned by root, then privilege
escalate to root for a standard user :
➔ Without AppArmor
All exploits will work
➔ With AppArmor
Our container will be safe
Slide 18
Slide 18 text
The code from
the live demo is
available @
https://github.com
/scotty-c