Breaking and Fixing your ‘Docker’ ized environments
summary
Co‑authored CIS Docker 1.12 benchmark gives the baseline and the work reports scanning of more than 50 Docker Hub images that reveal Heartbleed Shellshock and other critical flaws, shows defaults leave containers running as root and without user namespaces or ulimits, and demonstrates exploits for DOS, side‑channels and remote code execution. Recommendations include setting pinned base image versions, enabling Docker Content Trust/Notary, using binary/hash‑based scanning (Twistlock AquaSec Nautilus mentioned), hardening host kernels and applying seccomp/capability restrictions — demonstrations and scans show fixes work.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:49Experience with Docker containers
- 16:27Introduction to images
- 30:42How to maintain/consume images securely?
- 39:08Daeman Security
- 41:23Daemon Security
- 42:24Security controls on the host
- 45:06Few tips for enterprises
- 48:57Container runtime security
related talks
35mSecuring Containers by Breaking In
49mVulnerability Exploitation In Docker Container Environments
47mSecuring Containers By Breaking In
30mMaster the Container Security Model with
39mInsecure Containers? Continuous Defense Against Open Source Exploits
35mDocker Security
14mDocker Security
32mSecure containers - Michael Wager and Michael Helwig