3 ms·

Quick question/idea about security: with all of the exploits today like Meltdown and Spectre, is anyone working on a truly secure container? Something like a p

Quick question/idea about security: with all of the exploits today like Meltdown and Spectre, is anyone working on a truly secure container? Something like a public website running on an Intel processor, and/or maybe subdomains running on AMD and other mainstream CPUs. They would each be running some number of containers (up to say 1000 to start) and anyone could log in anonymously and run whatever they want in a minimal OS like Ubuntu. They would probably just have access to a small filesystem and maybe some open ports for HTTP or SSL or whatever. The challenge would be to break out and take over the host computer. If anyone does that, then the pwned container is flagged as not secure. The idea here is that until this happens, we can't really run a container and allow public access. I'd like containers to be as ubiquitous as websites running Javascript in the browser's sandbox so that we can host our own REPLs. If companies are serious about this, they should also consider providing bounties, say $100,000 guaranteeing that their container is secure for users. If you get hacked, you get the money. Without something like that, I'm afraid that I can't believe that containers are secure on faith alone.

lossolo 7y ago
This doesn't work like that. Containers (like docker, LXC and other based on cgroups etc) are isolated by the kernel but they share the same kernel. This means that kernel exploit will make all those containers insecure by your definition. If you go further and try to embed containers in hardware virtualization layer (so basically mini VMs) you still don't have any guarantees because from time to time new exploit emerges that allows to break out from guest OS to hypervisor. Then you have hardware layer and exploits based on speculative execution (Spectre, Meltdown and friends). Truly secure container doesn't exist. You would need some kind of mathematical proof for whole hardware stack and all communications between different hardware subsystems + whole kernel + container runtime.
- zackmorris 7y ago
  Hmmm that doesn't inspire a lot of confidence. I'd maybe be fine with a VM then, if containers fundamentally can't be made secure. Short of a mathematical "proof" of security, the best I could come up with was to leave containers open for the hackers of the world to exploit. If a container survives, that's a fairly strong guarantee that it can't be escaped (for now). What I am getting at is: if we know that hackers can break out of containers, then how are we ok with shared hosting running in containers? Once one gets owned, it's trivial to break into the others. Edit: this might be a way to force maintainers to fix kernel exploits as well.

lossolo 7y ago

This doesn't work like that. Containers (like docker, LXC and other based on cgroups etc) are isolated by the kernel but they share the same kernel. This means that kernel exploit will make all those containers insecure by your definition. If you go further and try to embed containers in hardware virtualization layer (so basically mini VMs) you still don't have any guarantees because from time to time new exploit emerges that allows to break out from guest OS to hypervisor. Then you have hardware layer and exploits based on speculative execution (Spectre, Meltdown and friends). Truly secure container doesn't exist. You would need some kind of mathematical proof for whole hardware stack and all communications between different hardware subsystems + whole kernel + container runtime.

zackmorris 7y ago
Hmmm that doesn't inspire a lot of confidence. I'd maybe be fine with a VM then, if containers fundamentally can't be made secure. Short of a mathematical "proof" of security, the best I could come up with was to leave containers open for the hackers of the world to exploit. If a container survives, that's a fairly strong guarantee that it can't be escaped (for now). What I am getting at is: if we know that hackers can break out of containers, then how are we ok with shared hosting running in containers? Once one gets owned, it's trivial to break into the others. Edit: this might be a way to force maintainers to fix kernel exploits as well.