4 ms·

Since Docker is not ready to officially be used in production: - Those of you using it in production, how are you handling security? - How secure has Docker p

by bliti 12y ago

Since Docker is not ready to officially be used in production: - Those of you using it in production, how are you handling security? - How secure has Docker proven to be in general?

brrt 12y ago
We are using docker in production. We have had many issues but none related to security. It's an interesting phrase: 'to officially be used in production'. Who is the official that officially signs docker to be ready? ;-)
- amouat 12y ago
  Well, Docker Inc called Docker production ready on the 1.0 release and took down all the "do not use in production" warnings.
justincormack 12y ago
Containers per se do not reduce security. Most of the security issues are related to other changes, eg if you switch from VMs to Docker you are removing the VMs that may have been providing security, thats not really a Docker issue per se. If you run stuff with increased privileges in containers (ie root, or some capabilities) then you may decrease security too, but your applications should not be doing this. You can argue that the docker daemon itself (which is a big monolithic process running as root) is a security issue (RedHat certainly do). You can also argue that it makes security processes harder, as you dont have workflows in place to audit containers, make sure they are updated etc, but thats a different issue.
- lclarkmichalek 12y ago
  Eeehhh, I'm going to go out on a limb and say that Docker containers, as of 1.6, do reduce security. Without user namespaces, container root is system root, and the number of images that run as container root is incredibly high (where they might otherwise be running as system non-root). 1.7 should change this, as we'll finally get user namespaces, though I don't know how many people will end up using them; let's hope they're on by default, I guess.
  - justincormack 12y ago
    But if you run stuff as root you already lost, container or not. Why are so many people running containers as root? Is it because they are running whole distros that expect that? User namespaces are going to be really complicated to work with not really convinced they are the panacea people expect. Not running as root is much easier!
    - lclarkmichalek 12y ago
      Sure. I'm just saying that running stuff as root is the de-facto standard in the container world; it isn't outside of the docker ecosystem. Take, for example, the docker registry image[0]. Runs as root. In what world, other than the docker world, would that be considered acceptable? [0] https://github.com/docker/docker-registry/blob/0.9.1/Dockerfile https://github.com/docker/docker-registry/blob/0.9.1/Dockerf...
  - rubiquity 12y ago
    By your logic that means all operating systems are insecure because users can run things as root. I've grown tired of hearing this argument against containers (not just Docker). It applies to security in general.
  - ewindisch 12y ago
    The container root certainly has UID 0, but it has reduced system capabilities. The irony of user namespaces is that they provide additional capabilities, but give you a fake UID-0 while "actually" running as a higher UID. This distinction is important because it's why, in practice, Docker's current approach has proven to be more secure than user namespaces. User namespaces allow various operations that would be outright denied under a Docker container's very-real-but-very-limited root user. However, yes, user namespaces are coming to Docker. It's a highly desired feature and eventually userns will mature.
    - lclarkmichalek 12y ago
      I'd be interested to see how the current approach has been proven to be more secure than userns, though I can well beleive it. I do agree that dropping capabilities is good, however, even with the reduced capabilities provided, the kernel is still a very large target, and so I would sleep a lot easier with userns active (in addition to capability (and mb even seccomp ;)) filtering) on all my containers. It just seems like such a free win (and I appreciate how that must sound to the people who are implementing it).
- ianstallings 12y ago
  Related discussion from Daniel Walsh at Redhat on security in Docker: https://www.youtube.com/watch?v=zWGFqMuEHdw https://www.youtube.com/watch?v=zWGFqMuEHdw
federico3 12y ago
>How secure has Docker proven to be in general? Very little compared to hardware-assisted virtualization like KVM. Unfortunately LXC containers are not designed with security in mind and, together with the rest of the kernel, provide a big attack surface.
- bsrx 12y ago
  Other than privilege escalation through the kernel, what attack surface do you see exposed? Might just be limited to my use case for Docker, but so far it's security agnostic.
bsrx 12y ago
What are your security concerns regarding Docker? Or what do you perceive to be common security flaws? So far I've perceived Docker to be like virtualenv for python - useful but orthogonal to any security practices.

by bliti 12y ago

Since Docker is not ready to officially be used in production: - Those of you using it in production, how are you handling security? - How secure has Docker proven to be in general?

brrt 12y ago

We are using docker in production. We have had many issues but none related to security. It's an interesting phrase: 'to officially be used in production'. Who is the official that officially signs docker to be ready? ;-)

amouat 12y ago
Well, Docker Inc called Docker production ready on the 1.0 release and took down all the "do not use in production" warnings.

justincormack 12y ago

Containers per se do not reduce security. Most of the security issues are related to other changes, eg if you switch from VMs to Docker you are removing the VMs that may have been providing security, thats not really a Docker issue per se. If you run stuff with increased privileges in containers (ie root, or some capabilities) then you may decrease security too, but your applications should not be doing this. You can argue that the docker daemon itself (which is a big monolithic process running as root) is a security issue (RedHat certainly do). You can also argue that it makes security processes harder, as you dont have workflows in place to audit containers, make sure they are updated etc, but thats a different issue.

lclarkmichalek 12y ago
Eeehhh, I'm going to go out on a limb and say that Docker containers, as of 1.6, do reduce security. Without user namespaces, container root is system root, and the number of images that run as container root is incredibly high (where they might otherwise be running as system non-root). 1.7 should change this, as we'll finally get user namespaces, though I don't know how many people will end up using them; let's hope they're on by default, I guess.
- justincormack 12y ago
  But if you run stuff as root you already lost, container or not. Why are so many people running containers as root? Is it because they are running whole distros that expect that? User namespaces are going to be really complicated to work with not really convinced they are the panacea people expect. Not running as root is much easier!
  - lclarkmichalek 12y ago
    Sure. I'm just saying that running stuff as root is the de-facto standard in the container world; it isn't outside of the docker ecosystem. Take, for example, the docker registry image[0]. Runs as root. In what world, other than the docker world, would that be considered acceptable? [0] https://github.com/docker/docker-registry/blob/0.9.1/Dockerfile https://github.com/docker/docker-registry/blob/0.9.1/Dockerf...
- rubiquity 12y ago
  By your logic that means all operating systems are insecure because users can run things as root. I've grown tired of hearing this argument against containers (not just Docker). It applies to security in general.
- ewindisch 12y ago
  The container root certainly has UID 0, but it has reduced system capabilities. The irony of user namespaces is that they provide additional capabilities, but give you a fake UID-0 while "actually" running as a higher UID. This distinction is important because it's why, in practice, Docker's current approach has proven to be more secure than user namespaces. User namespaces allow various operations that would be outright denied under a Docker container's very-real-but-very-limited root user. However, yes, user namespaces are coming to Docker. It's a highly desired feature and eventually userns will mature.
  - lclarkmichalek 12y ago
    I'd be interested to see how the current approach has been proven to be more secure than userns, though I can well beleive it. I do agree that dropping capabilities is good, however, even with the reduced capabilities provided, the kernel is still a very large target, and so I would sleep a lot easier with userns active (in addition to capability (and mb even seccomp ;)) filtering) on all my containers. It just seems like such a free win (and I appreciate how that must sound to the people who are implementing it).
ianstallings 12y ago
Related discussion from Daniel Walsh at Redhat on security in Docker: https://www.youtube.com/watch?v=zWGFqMuEHdw https://www.youtube.com/watch?v=zWGFqMuEHdw

federico3 12y ago

>How secure has Docker proven to be in general? Very little compared to hardware-assisted virtualization like KVM. Unfortunately LXC containers are not designed with security in mind and, together with the rest of the kernel, provide a big attack surface.

bsrx 12y ago
Other than privilege escalation through the kernel, what attack surface do you see exposed? Might just be limited to my use case for Docker, but so far it's security agnostic.

bsrx 12y ago

What are your security concerns regarding Docker? Or what do you perceive to be common security flaws? So far I've perceived Docker to be like virtualenv for python - useful but orthogonal to any security practices.