Vulnerability Exploitation In Docker Container Environments
summary
Analysis finds over 90% official images vulnerable and an average >20 CVEs per image on Docker Hub, with examples like a MySQL image showing ~30 CVEs and an Elasticsearch instance reused in a botnet. Docker hosts run containers as root, expose neighbor network configs, and process compressed layers so daemon bugs in XZ/tar/gzip parsers or careless install scripts (curl | sh) let attackers gain host root. Short-term fixes: rebuild and scan images, prefer tiny statically linked containers, enable user namespaces.
AI-written summary · about
chapters (17)
- 0:00ABOUT ANTHONY BETTINI
- 2:55CONTROL GROUPS (CGROUPS)
- 4:57DOCKER VS. LXC
- 6:09DOCKER BASICS
- 6:39DOCKER REMOTE API EVENTS (ARCHITECTURE)
- 7:52LINUX NAMESPACES
- 8:31USER NAMESPACES
- 11:53VULNERABILITIES & MALWARE
- 14:47DOCKER INSTALLATION
- 15:24DOCKER NETWORKING
- 17:40DOCKER ESCAPE (FIXED)
- 19:30DECOMPRESSION HIGHEST ROI ATTACK VECTOR
- 21:46BASH IN A DOCKER CONTAINER?
- 24:21MODERN ANALOGY
- 24:47ANDROID MALWARE
- 25:52IS ELF MALWARE REALLY A CONCERN?
- 27:12DOCKER HUB
related talks
35mSecuring Containers by Breaking In
47mSecuring Containers By Breaking In
29mDay in the Life of a Base Image: The Evolution of Vulnerabilities in the Most Popular C...
40mSecuring Containers by Breaking in
32mContainer Security: Exploits, Vulnerabilities and Defense
35mDocker Security
57mBreaking and Fixing your ‘Docker’ ized environments
30mMaster the Container Security Model with