3 ms·

Listening to what the Docker people write about security, they sure do sound like they are designed to be secure, even though they admit to a couple of potentia

by zurn 11y ago

Listening to what the Docker people write about security, they sure do sound like they are designed to be secure, even though they admit to a couple of potential shortcomings versus VMs. https://blog.docker.com/2013/08/containers-docker-how-secure-are-they/ https://blog.docker.com/2013/08/containers-docker-how-secure... concludes, "Docker containers are, by default, quite secure; especially if you take care of running your processes inside the containers as non-privileged users (i.e. non root)." They also recommend using SELinux with Docker to beef up security (see https://blog.docker.com/2014/07/new-dockercon-video-docker-security-renamed-from-docker-and-selinux/ https://blog.docker.com/2014/07/new-dockercon-video-docker-s...) As long as people are using containers as a security boundary it makes sense to pay attention to things like this one about the control socket.

kentonv 11y ago
There is a section in that link titled "Specific Attack Surface of the Docker Daemon". Meanwhile they are ignoring the attack surface of the Linux kernel. There is no mention of seccomp in the whole post. People find privilege escalation bugs in the Linux kernel often enough that you can't really claim that running arbitrary native code is "secure" unless you're doing something to mitigate these. Things like: http://www.openwall.com/lists/oss-security/2015/07/22/7 http://www.openwall.com/lists/oss-security/2015/07/22/7 Note that SELinux won't do anything about this kind of bug. You have to use seccomp and similar to disable large swaths of the Linux kernel API, particularly exotic parts that aren't well-tested or reviewed.
- throwaway2048 11y ago
  there is no mention of seccomp because virtually no software can utilize it.
  - geofft 11y ago
    As a Chrome, systemd, and Sandstorm user, I'm a little curious what you mean.
  - kentonv 11y ago
    Sandstorm.io (disclosure: my project) applies mandatory seccomp and other attack surface reduction yet manages to run a lot of apps with only minimal modification: https://docs.sandstorm.io/en/latest/developing/security-practices/#server-sandboxing https://docs.sandstorm.io/en/latest/developing/security-prac... Admittedly, though, "only minimal modification" is probably too much modification for Docker's goals. That's fair. But I don't think that gives them a pass to pretend the problem doesn't exist.
  - rwmj 11y ago
    qemu uses seccomp. If you run your VMs with libvirt, then seccomp can be used to protect the host from qemu easily and routinely.
  - simoncion 11y ago
    OpenSSH and BIND use seccomp. :)
DyslexicAtheist 11y ago
I second the idea of using SElinux to secure docker because most people really are not able to fully deal with the complexity of SElinux. If they would understand security they wouldn't be jumping onto the docker hype bandwagon in the first place. To paraphrase Theo de Raadt: ‟You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can’t write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.” [1] http://blog.valbonne-consulting.com/2015/04/14/as-a-goat-im-skeptical-of-dockers-hype/ http://blog.valbonne-consulting.com/2015/04/14/as-a-goat-im-...

by zurn 11y ago

kentonv 11y ago

There is a section in that link titled "Specific Attack Surface of the Docker Daemon". Meanwhile they are ignoring the attack surface of the Linux kernel. There is no mention of seccomp in the whole post. People find privilege escalation bugs in the Linux kernel often enough that you can't really claim that running arbitrary native code is "secure" unless you're doing something to mitigate these. Things like: http://www.openwall.com/lists/oss-security/2015/07/22/7 http://www.openwall.com/lists/oss-security/2015/07/22/7 Note that SELinux won't do anything about this kind of bug. You have to use seccomp and similar to disable large swaths of the Linux kernel API, particularly exotic parts that aren't well-tested or reviewed.

throwaway2048 11y ago
there is no mention of seccomp because virtually no software can utilize it.
- geofft 11y ago
  As a Chrome, systemd, and Sandstorm user, I'm a little curious what you mean.
- kentonv 11y ago
  Sandstorm.io (disclosure: my project) applies mandatory seccomp and other attack surface reduction yet manages to run a lot of apps with only minimal modification: https://docs.sandstorm.io/en/latest/developing/security-practices/#server-sandboxing https://docs.sandstorm.io/en/latest/developing/security-prac... Admittedly, though, "only minimal modification" is probably too much modification for Docker's goals. That's fair. But I don't think that gives them a pass to pretend the problem doesn't exist.
- rwmj 11y ago
  qemu uses seccomp. If you run your VMs with libvirt, then seccomp can be used to protect the host from qemu easily and routinely.
- simoncion 11y ago
  OpenSSH and BIND use seccomp. :)

DyslexicAtheist 11y ago

I second the idea of using SElinux to secure docker because most people really are not able to fully deal with the complexity of SElinux. If they would understand security they wouldn't be jumping onto the docker hype bandwagon in the first place. To paraphrase Theo de Raadt: ‟You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can’t write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.” [1] http://blog.valbonne-consulting.com/2015/04/14/as-a-goat-im-skeptical-of-dockers-hype/ http://blog.valbonne-consulting.com/2015/04/14/as-a-goat-im-...