4 ms·
This looks like the attacker is just using a publicly exposed Docker API honeypot to run a new Docker container with `privileged: true`. I don't see why that's
by terom 6y ago
This looks like the attacker is just using a publicly exposed Docker API honeypot to run a new Docker container with `privileged: true`. I don't see why that's particularly interesting given that they could just bind-mount the host / filesystem with `pid: host` and do pretty much whatever they want?
It would be much more interesting to see a remote-code-execution attack against some vulnerable service deploying a container escape payload to escalate privileges from the Docker container to the host.
- imglorp 6y agoExposed on the WAN is obviously bad, but how do you keep your own containers from calling those APIs? Yes, you don't mount the docker socket in the container, but what about the orchestrator APIs?
- detaro 6y agoThey're supposed to require authentication. E.g. with docker commonly mutual TLS auth.
- kuschku 6y agoWith kubernetes, you enable RBAC, and only allow each pod the absolute minimum of access required. In my own setup, I have only five pods with any privileges: kubernetes-dashboard, nginx-ingress, prometheus, cert-manager, and the gitlab-runner, and of those only kubernetes-dashboard can modify existing pods in all spaces, cert-manager can only write secrets of its own custom type, and gitlab-runner can spawn non-privileged pods in its own namespace (but not mount anything from the host, nor any resources from any other namespace). And when building docker images in the CI, I use google’s kaniko to build docker images from within docker without any privileges (it unpacks docker images for building and runs them inside the existing container, basically just chroot). All these APIs are marked very clearly and obviously as DO NOT MAKE AVAILABLE PUBLICLY. If you still make them public, well it’s pretty much your own fault.
- ipodopt 6y agoDoes RBAC not limit these by default? Does cert-manger not already give itself restricted permission on install? Do I need to fix up my cluster right now? If so, do you have any example RBAC yamls? :D > And when building docker images in the CI, I use google’s kaniko to build docker images from within docker without any privileges (it unpacks docker images for building and runs them inside the existing container, basically just chroot). You can also use standalone buildkit which comes with the added benefit of being able to use the same builder locally natively.
- threentaway 6y agoNo RBAC doesn't automatically do this. And many publicly available Helm charts are missing these basic security configurations. You should use Gatekeeper or similar to enforce these settings throughout your cluster.
- westurner 6y agoGatekeeper docs: https://open-policy-agent.github.io/gatekeeper/website/docs/ https://open-policy-agent.github.io/gatekeeper/website/docs/ Gatekeeper src: https://github.com/open-policy-agent/gatekeeper https://github.com/open-policy-agent/gatekeeper awesome-container-security: https://github.com/kai5263499/awesome-container-security https://github.com/kai5263499/awesome-container-security "container-security" GitHub label: https://github.com/topics/container-security https://github.com/topics/container-security
- rhizome 6y agoEveryday DevOps strays further from SysAdmin's light.