Docker and Security

http://blog.docker.io/2014/02/docker-and-security/

by mwcampbell • 12 years ago

31 13 12 years ago

blog.docker.io

aroch• 12 years ago

So, does Docker run their blog in its own docker container? If so, it crashed!

jamtur012• 12 years ago

Oops. Looks like a little hiccup but we're back.

kbar13• 12 years ago

502 Bad Gateway

Reply

kogir• 12 years ago

Containers are great for isolating trusted applications from one another to ease deployment, but using them for multi-tenant security is ill advised.

Since all containers share the same kernel, any local privilege escalation vulnerability in Linux can be used to escape the container. Such vulnerabilities are much more common than vulnerabilities in mature hypervisors, so virtualization is the safer choice.

Reply

sarnowski• 12 years ago

Agree. I keep telling that container may provide some benefits but its really not security (especially docker which uses LXC which is still not complete und as you said uses a shared kernel - one plus point is Ubuntu's combination with AppArmor which mitigates certain attacks but configuring AppArmor is itself often overseen. Other distros are worse).

If you want to secure one app from another, just use separate hardware.

Reply

tptacek• 12 years ago

This, and also bear in mind that kernel crypto state, particularly for the RNG, is shared.

Reply

sneak• 12 years ago

Oh, fuck. I hadn't even thought of that. That's disaster.

Reply

viraptor• 12 years ago

Could you explain what the implications are? I can see it going really bad if the simple dev/urandom is shared, but what are the practical risks for dev/random? (apart from the simple dos on host/all containers by draining)

Reply

voltagex_2• 12 years ago

Was this written in response to an irresponsible disclosure?

Reply

nickstinemates• 12 years ago

Not at all, it was written as a result of a presentation we gave and was easily converted in to a blog post.

Reply

jamtur012• 12 years ago

We didn't have an irresponsible disclosure. We did recently present some of this information and were asked about our security policy. That policy wasn't yet published or announced so we decided it was important to get it out there, especially leading up to the Docker 1.0 release.

Please feel free to contact me, james@docker.com, if you have any questions or concerns about the policy.

Thanks!

Reply

voltagex_2• 12 years ago

Hm, maybe my comment sounded more harsh than I meant it to - I was more curious because I've seen similar statements from other companies after something bad had happened. Thanks for clarifying.

Reply

Docker and Security

Related Stories