3 ms·
I would manage a private registry. It's no different than trusting code in a 3pp library. I'd vet the code before running it. In some cases, you are giving the
by k4ch0w 8y ago
I would manage a private registry.
It's no different than trusting code in a 3pp library. I'd vet the code before running it. In some cases, you are giving the running container root access to your computer. Take a look at the Dirty Cow to exploit that allows you to break out of the container and control the host.
https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-docker-container-escape/ https://blog.paranoidsoftware.com/dirty-cow-cve-2016-5195-do...
You never know what people will put into their images. I built a tool to help reverse engineer images to find files people put in their images here.
https://github.com/P3GLEG/Whaler https://github.com/P3GLEG/Whaler
I have found so much weird stuff that people build into the containers. I wouldn't trust them implicitly because it's a packaged black box.
- amirathi 8y agoWhaler looks great. As I understand it, it gives us a Dockerfile for a given image. Do you know if it's possible to reverse engineer the entire source code of my app from the Docker image?
- k4ch0w 8y agoIt depends on the language it was compiled in. It'll help you retrieve the binary, but you need to use the right tool to get the source code from it. It's not different than download an app on your host machine. It just make it easier for you to see what people put in an image. Android/Java is a language you can get the entire source from excluding if they obfuscate it.
- cgrater 8y agoThanks, that's a really useful tool and a good write-up on the utility of it. In the short term I can probably convince the higher-ups that if I download the images manually and do some level of investigation using a tool like yours then it should account for some security. Have you considered container scanning tools?
- geberl 8y agoThanks for Whaler, looks nice. I only knew about https://microbadger.com/ https://microbadger.com/ until now, but Whaler puts out more info.