Docker Security: Difference between revisions
| Line 22: | Line 22: | ||
A ''privileged container'', also referred to as a ''super privileged container'' (SPC) or an ''infrastructure container'', is a special container elevated privileges administrators use to perform administrative tasks as management, monitoring, backups, etc. Privileged containers can load specialized kernel modules, for example. Typically there's a tighter coupling between privileged containers and the host kernel. When using a privileged container, the administrator needs to select a user space that is compatible with the host kernel. | A ''privileged container'', also referred to as a ''super privileged container'' (SPC) or an ''infrastructure container'', is a special container elevated privileges administrators use to perform administrative tasks as management, monitoring, backups, etc. Privileged containers can load specialized kernel modules, for example. Typically there's a tighter coupling between privileged containers and the host kernel. When using a privileged container, the administrator needs to select a user space that is compatible with the host kernel. | ||
Also see: {{Internal|#Container|Container}} {{Internal|OpenShift Security Context Constraints#Overview|OpenShift Security Context Constraints}} | Also see: {{Internal|#Container|Container}} {{Internal|OpenShift Security Context Constraints#Overview|OpenShift Security Context Constraints}} {{Internal|Linux_Security_Concepts#Privileged_Mode|Linux Security Concepts | Privileged Mode}} | ||
=Secret= | =Secret= | ||
{{External|https://docs.docker.com/engine/swarm/secrets/}} | {{External|https://docs.docker.com/engine/swarm/secrets/}} | ||
Revision as of 00:29, 2 March 2021
External
- https://docs.docker.com/engine/security/security/
- http://opensource.com/business/14/7/docker-security-selinux
- https://medium.com/@ewindisch/on-the-security-of-containers-2c60ffe25a9e
- https://opensource.com/business/15/3/docker-security-tuning
Internal
Overview
Production containers should almost always be run under the context of a non-privileged user, because there is potential to allow root level access to host resources, as in the case of the bind mounts. See Dockerfile USER.
Linux Kernel Capabilities
Privileged Container
A privileged container, also referred to as a super privileged container (SPC) or an infrastructure container, is a special container elevated privileges administrators use to perform administrative tasks as management, monitoring, backups, etc. Privileged containers can load specialized kernel modules, for example. Typically there's a tighter coupling between privileged containers and the host kernel. When using a privileged container, the administrator needs to select a user space that is compatible with the host kernel.
Also see: