Docker Security
summary
Containers share the kernel so kernel attacks and container breakouts are real risks; an image scan of Debian finds 113 high vulnerabilities while a minimal Alpine image shows zero vulnerabilities. Practical mitigations shown include enforcing a read-only filesystem (which prevents file tampering but does not stop remote code execution), dropping Linux capabilities, setting CPU and memory limits, removing setuid binaries, using SELinux/AppArmor, scanning images with Clair/Twistlock/AtomicScan, and storing secrets in Vault or Keywhiz via volume plugins.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:03OVERVIEW
- 2:55KERNEL ATTACKS
- 3:29CONTAINER BREAKOUTS
- 4:01SNIFFING SECRETS
- 5:04LEAST PRIVILEGE
- 8:45HOW TO MITIGATE
- 9:44NOT A SOLUTION!
- 10:15IMAGE SCANNING
- 11:57USE CONTAINERS AND VMS
- 12:51DOCKER PRIVILEGES
- 15:52DROP CAPABILITIES
- 17:24SET CPUSHARES
- 18:36SET MEMORY LIMITS
- 19:02DEFANG SETUID/SETGID BINARIES
- 20:41USE MINIMAL IMAGES
- 21:29USE LINUX SECURITY MODULES
- 21:40SELINUX
- 24:10SECURITY HARDENED KERNEL
- 24:53VERIFY IMAGES
- 26:48AUDITING
- 28:41ENVIRONMENT VARIABLES
- 29:51SECURE KEY-VALUE STORE
- 31:28CONCLUSION
related talks
35mSecuring Containers by Breaking In
29m5 Security Best Practices For Production Ready Containers
14mDocker Security
26mThe 10 Container Security Tricks That (...)
30mMaster the Container Security Model with
49mVulnerability Exploitation In Docker Container Environments
50mInsights in Container Security
33mContainers Security Layers and How Not to Break them