{"id":237591,"date":"2021-04-28T16:00:24","date_gmt":"2021-04-28T13:00:24","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/how-to-assess-docker-engine-security-cloudsavvy-it\/"},"modified":"2021-04-28T16:00:24","modified_gmt":"2021-04-28T13:00:24","slug":"how-to-assess-docker-engine-security-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/how-to-assess-docker-engine-security-cloudsavvy-it\/","title":{"rendered":"#How to Assess Docker Engine Security \u2013 CloudSavvy IT"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af0c59d3038c\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af0c59d3038c\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-assess-docker-engine-security-cloudsavvy-it\/#Understanding_Dockers_Architecture\" >Understanding Docker\u2019s Architecture<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-assess-docker-engine-security-cloudsavvy-it\/#The_Attack_Surface\" >The Attack Surface<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-assess-docker-engine-security-cloudsavvy-it\/#Rootless_Mode\" >Rootless Mode<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-assess-docker-engine-security-cloudsavvy-it\/#REST_API_Security\" >REST API Security<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-assess-docker-engine-security-cloudsavvy-it\/#Limiting_Communication_Between_Containers\" >Limiting Communication Between Containers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-assess-docker-engine-security-cloudsavvy-it\/#Restrict_Conainer_Capabilities\" >Restrict Conainer Capabilities<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-assess-docker-engine-security-cloudsavvy-it\/#Enable_Built-In_Kernel_Features\" >Enable Built-In Kernel Features<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-assess-docker-engine-security-cloudsavvy-it\/#The_Basics\" >The Basics<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#How to Assess Docker Engine Security \u2013 CloudSavvy IT&#8221;<\/strong><\/p>\n<div id=\"article-content-area\">\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-10864\" data-pagespeed-lazy-src=\"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/04\/075c8694.jpeg?width=1200&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"\" width=\"1600\" height=\"900\" src=\"\/pagespeed_static\/1.JiBnMqyl6S.gif\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><\/p>\n<p>Docker lets software developers and DevOps engineers rapidly package <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>lications for production. Docker containers operate largely independently of their host but aren\u2019t impervious to security threats. Here\u2019s how to audit your Docker Engine installation to ensure maximum security for your host and your workloads.<\/p>\n<h2 id=\"understanding-dockers-architecture\"><span class=\"ez-toc-section\" id=\"Understanding_Dockers_Architecture\"><\/span>Understanding Docker\u2019s Architecture<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The first step to assessing Docker risks is to understand how the <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" data-internallinksmanager029f6b8e52c=\"4\" title=\"Technology\" target=\"_blank\" rel=\"noopener\">technology<\/a> actually works. Docker\u2019s powered by three distinct components:<\/p>\n<ul>\n<li><strong>Docker Engine daemon<\/strong> \u2013 The background service which manages behind-the-scenes operations with containers and images.<\/li>\n<li><strong>REST API<\/strong> \u2013 Docker Engine provides a REST API which sends commands to the Docker daemon. The API is usually provided over a REST socket but may also be exposed over HTTP.<\/li>\n<li><strong>Docker command-line client<\/strong> \u2013 The Docker CLI runs when you use <code>docker<\/code> in a terminal. It sends commands to the Docker daemon. Commands are processed to determine the action to take.<\/li>\n<\/ul>\n<p>An attacker compromising any of these components could gain access to your environment. Through proper configuration, you can protect your workloads and <em>increase<\/em> security compared to running applications directly on the host.<\/p>\n<h2 id=\"the-attack-surface\"><span class=\"ez-toc-section\" id=\"The_Attack_Surface\"><\/span>The Attack Surface<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The Docker daemon presents the largest attack surface. Gaining control of the daemon provides access to the host and all your containers. The daemon usually runs as <code>root<\/code>, so a successful infiltration can grant unrestricted access to your physical machine.<\/p>\n<p>You should ensure the Docker daemon socket (<code>\/var\/run\/docker.sock<\/code>) is not accessible to anyone other than the <code>root<\/code> user. As the daemon can access the host, providing access to the socket effectively hands off control of your machine.<\/p>\n<p>Docker\u2019s daemon supports <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.docker.com\/engine\/security\/protect-access\/\">a TCP socket<\/a> that enables remote control over the network. If you enable this feature, unencrypted communication will be offered without any authentication.<\/p>\n<p>Avoid using TCP connections unless you\u2019re in a network environment which you\u2019ve specifically configured to be safe. You should set up TLS and ensure only authorised clients are allowed to connect.<\/p>\n<p>Some Docker images may require you to mount the Docker socket into the container. This is often used by Docker management tools that provide an interface to containers running on your host. By mounting the socket in this way, anything inside the container could gain control of your system. Containers should never receive a Docker socket unless you\u2019re sure the workload requires one.<\/p>\n<h2 id=\"rootless-mode\"><span class=\"ez-toc-section\" id=\"Rootless_Mode\"><\/span>Rootless Mode<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Docker now supports a <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.docker.com\/engine\/security\/rootless\">rootless mode<\/a> which lets you run Docker without <code>root<\/code> access. This helps to improve security but comes with additional complexity at setup time.<\/p>\n<p>Using rootless mode runs Docker and your containers inside a user namespace. Most Docker features will work, although there are <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.docker.com\/engine\/security\/rootless\">some limitations<\/a>.<\/p>\n<p>Not every storage driver is available, overlay networks are unsupported and container networks are fully namespaced. This means you can\u2019t directly access container IPs from the host without first entering the dedicated networking namespace.<\/p>\n<p>Using rootless mode can be helpful in high-security environments where the integrity of the host is paramount. It helps lessen the impact of a successful attack by restricting opportunities to tamper with the wider system.<\/p>\n<h2 id=\"rest-api-security\"><span class=\"ez-toc-section\" id=\"REST_API_Security\"><\/span>REST API Security<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The Docker REST API is usually accessed via a UNIX socket. Permission checks are made using standard UNIX mechanisms.<\/p>\n<p>You can expose the API over a TCP socket, enabling access via HTTP. This raises the risk of compromise. You should make sure your network access controls are set so traffic can only originate from approved hosts.<\/p>\n<p>You should audit your firewall policies so you don\u2019t overlook a device which could interact with the Docker API. Remember that limiting connections to <code>localhost<\/code> isn\u2019t sufficient \u2013 this would still permit access from within Docker containers running on your machine, potentially enabling unintended privilege escalation.<\/p>\n<h2 id=\"limiting-communication-between-containers\"><span class=\"ez-toc-section\" id=\"Limiting_Communication_Between_Containers\"><\/span>Limiting Communication Between Containers<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Docker allows all containers to communicate with each other over the default <code>docker0<\/code> bridged network. A compromised container could snoop around this network to learn about its environment. It could use the bridge network as a vantage point to begin a wider infiltration of your workloads.<\/p>\n<p>Disabling inter-container communication improves your security posture by enhancing container isolation. You\u2019ll need to explicitly <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.docker.com\/v17.09\/engine\/userguide\/networking\/default_network\/container-communication\/#communication-between-containers\">link containers<\/a> together using the <code>--link=ContainerName<\/code> flag or your own Docker network.<\/p>\n<p>Run Docker daemon with the <code>--icc=false<\/code> flag to disable communication over the <code>docker0<\/code> bridge.<\/p>\n<h2 id=\"restrict-conainer-capabilities\"><span class=\"ez-toc-section\" id=\"Restrict_Conainer_Capabilities\"><\/span>Restrict Conainer Capabilities<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Linux kernel capabilities define the actions available to users with <code>root<\/code> access. Capabilities help to lockdown processes which are running as <code>root<\/code>, such as Docker containers. Each process should be given the minimum set of capabilities it needs.<\/p>\n<p>Docker automatically runs containers with a limited selection of capabilities. Even this list is often excessive for a simple workload such as a web server. You can restrict it further by specifying your own list of capabilities available to a container.<\/p>\n<pre>docker run --cap-drop all --cap-add SYSLOG example-image:latest<\/pre>\n<p>The above command will run a container with only the <code>SYSLOG<\/code> capability. The <code>--cap-drop<\/code> flag disregards the default capability list. Capabilities are then added back with <code>--cap-add<\/code>, creating a whitelist.<\/p>\n<p>It\u2019s worth assessing your container against the <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/man7.org\/linux\/man-pages\/man7\/capabilities.7.html\">kernel capability list<\/a>. Drop any unused capabilities from containers running in production. This helps limit the damage a compromised container can cause.<\/p>\n<h2 id=\"enable-built-in-kernel-features\"><span class=\"ez-toc-section\" id=\"Enable_Built-In_Kernel_Features\"><\/span>Enable Built-In Kernel Features<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Don\u2019t disregard the security features built-in to your kernel. Docker works with existing technologies such as AppArmor and SELinux.<\/p>\n<p>Some distributions, such as RedHat Linux, <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/access.redhat.com\/documentation\/en-us\/red_hat_enterprise_linux_atomic_host\/7\/html-single\/getting_started_with_containers\/index\">come with predefined<\/a> SELinux system policies that augment Docker\u2019s security. You can manually add SELinux support by running the Docker daemon with the <code>--selinux-enabled<\/code> flag. This <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.docker.com\/engine\/reference\/commandline\/dockerd\">activates a<\/a> Docker policy to set SELinux labels on your containers. SELinux provides better isolation of container processes from host processes, improving your security posture.<\/p>\n<h2 id=\"the-basics\"><span class=\"ez-toc-section\" id=\"The_Basics\"><\/span>The Basics<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>It\u2019s easy to fixate on the complicated aspects of Docker security: rootless mode, daemon access and container communications. Don\u2019t overlook the basics though \u2013 standard security practice still applies.<\/p>\n<p>Always keep Docker Engine updated so you\u2019ve got the latest bug fixes. You should also ensure your host\u2019s kernel is fully patched. As containers share the same kernel as your host, any vulnerabilities could be exploited by your containerised applications.<\/p>\n<p>It\u2019s <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.docker.com\/engine\/security\/rootless\">good practice to dedicate<\/a> a specific physical machine or VM to running Docker. Don\u2019t run any other services directly on the host. You can run them as containers instead, lessening the impact of a successful host compromise.<\/p>\n<p>When configured correctly, Docker increases security by isolating applications. Taking the time to assess your position helps you identify potential risks and understand how attacks could begin. Locking down container privileges, protecting the Docker daemon and keeping your host updated will help you harden your containers.\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.cloudsavvyit.com\/10863\/how-to-assess-docker-engine-security\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#How to Assess Docker Engine Security \u2013 CloudSavvy IT&#8221; Docker lets software developers and DevOps engineers rapidly package applications for production. Docker containers operate largely independently of their host but aren\u2019t impervious to security threats. Here\u2019s how to audit your Docker Engine installation to ensure maximum security for your host and your workloads. Understanding Docker\u2019s&#8230;<\/p>\n","protected":false},"author":1,"featured_media":237592,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/04\/075c8694.jpeg","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-237591","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/237591","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=237591"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/237591\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/237592"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=237591"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=237591"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=237591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}