5 ms·

I thought that Docker containers were primarily intended for environment isolation, not for security? As I understood it, Docker relies on the kernel enforcing

by tjohns 10y ago

I thought that Docker containers were primarily intended for environment isolation, not for security? As I understood it, Docker relies on the kernel enforcing syscall namespaces for security... and that there's a (admittedly small) possibility of container breakouts via this route, because of the large surface area involved. Even the Docker devs have a whitepaper that recommends running Docker inside a VM when multi-tenancy is involved, as part of a defence-in-depth strategy: https://d3oypxn00j2a10.cloudfront.net/assets/img/Docker%20Security/WP_Intro_to_container_security_03.20.2015.pdf https://d3oypxn00j2a10.cloudfront.net/assets/img/Docker%20Se...

timthelion 10y ago
The surface area for both technologies is the same: The kernel. Howerver, SELinux uses a complex set of rules for determining access rights, while containers use basic bindmounts.
cyphar 10y ago
Docker uses SELinux, seccomp and apparmour as well as stock Linux capabilities (in conjunction with namespaces) to reduce the attack surface exposed to a container. There's nothing inherently insecure about containers (look at FreeBSD and Solaris). The issues you see with Linux "containers" are usually caused by leaky abstractions (namespaces that don't namespace the entire kernel) and insufficiently clever setup scripts. But it is getting better.
raesene6 10y ago
One thing to watch out for when reading anything about container/Docker security is the date of the advice. that paper is from March last year, and there have been a lot of improvements to Docker security since then. Docker makes use of namespaces/capabilities/cgroups and syscall filtering by default and you can add apparmour or SELinux policies on top if you like. So the attack surface of a running docker container very much depends on how you've configured it. It's likely still larger than a VM Hypervisor, but I know that there are large organisations using containers for multi-tenancy, so I guess some people are ok with that kind of configuration...

by tjohns 10y ago

timthelion 10y ago

The surface area for both technologies is the same: The kernel. Howerver, SELinux uses a complex set of rules for determining access rights, while containers use basic bindmounts.

cyphar 10y ago

Docker uses SELinux, seccomp and apparmour as well as stock Linux capabilities (in conjunction with namespaces) to reduce the attack surface exposed to a container. There's nothing inherently insecure about containers (look at FreeBSD and Solaris). The issues you see with Linux "containers" are usually caused by leaky abstractions (namespaces that don't namespace the entire kernel) and insufficiently clever setup scripts. But it is getting better.

raesene6 10y ago

One thing to watch out for when reading anything about container/Docker security is the date of the advice. that paper is from March last year, and there have been a lot of improvements to Docker security since then. Docker makes use of namespaces/capabilities/cgroups and syscall filtering by default and you can add apparmour or SELinux policies on top if you like. So the attack surface of a running docker container very much depends on how you've configured it. It's likely still larger than a VM Hypervisor, but I know that there are large organisations using containers for multi-tenancy, so I guess some people are ok with that kind of configuration...