Docker Security

External

• https://docs.docker.com/engine/security/security/
• http://opensource.com/business/14/7/docker-security-selinux
• https://medium.com/@ewindisch/on-the-security-of-containers-2c60ffe25a9e
• https://opensource.com/business/15/3/docker-security-tuning

Internal

• Docker Concepts
• Dockerfile USER

Overview

Production containers should almost always be run under the context of a non-privileged user, because there is potential to allow root level access to host resources, as in the case of the bind mounts. See Dockerfile USER.

Linux Kernel Capabilities

Linux Capabilities

Privileged Container

A privileged container, also referred to as a super privileged container (SPC) or an infrastructure container, is a special container elevated privileges administrators use to perform administrative tasks as management, monitoring, backups, etc. Privileged containers can load specialized kernel modules, for example. Typically there's a tighter coupling between privileged containers and the host kernel. When using a privileged container, the administrator needs to select a user space that is compatible with the host kernel.

If a container runs in privileged mode, it has access to all devices on the host, which allows the container nearly all the same access as processes running on the host. This is useful for containers that want to use capabilities like manipulating the network stack.

This is how 'ls /dev' looks for an unprivileged container:

# ls /dev
core  fd  full	mqueue	null  ptmx  pts  random  shm  stderr  stdin  stdout  termination-log  tty  urandom  zero

This is how 'ls /dev' looks for a privileged container:

# ls /dev
cachefiles	 fuse	       loop1  mapper		nbd11  nbd4  network_latency	 pts	ram14  ram7    stdin		tty11  tty18  tty24  tty30  tty37  tty43  tty5	 tty56	tty62  ttyS2	vcsa1
core		 hpet	       loop2  mem		nbd12  nbd5  network_throughput  ram0	ram15  ram8    stdout		tty12  tty19  tty25  tty31  tty38  tty44  tty50  tty57	tty63  ttyS3	vcsu
cpu		 hwrng	       loop3  memory_bandwidth	nbd13  nbd6  null		 ram1	ram2   ram9    termination-log	tty13  tty2   tty26  tty32  tty39  tty45  tty51  tty58	tty7   uinput	vcsu1
cpu_dma_latency  input	       loop4  mqueue		nbd14  nbd7  nvram		 ram10	ram3   random  tty		tty14  tty20  tty27  tty33  tty4   tty46  tty52  tty59	tty8   urandom	vda
cuse		 kmsg	       loop5  nbd0		nbd15  nbd8  port		 ram11	ram4   rtc0    tty0		tty15  tty21  tty28  tty34  tty40  tty47  tty53  tty6	tty9   vcs	vda1
fd		 loop-control  loop6  nbd1		nbd2   nbd9  psaux		 ram12	ram5   shm     tty1		tty16  tty22  tty29  tty35  tty41  tty48  tty54  tty60	ttyS0  vcs1	vsock
full		 loop0	       loop7  nbd10		nbd3   net   ptmx		 ram13	ram6   stderr  tty10		tty17  tty23  tty3   tty36  tty42  tty49  tty55  tty61	ttyS1  vcsa	zero

Also see:

Linux Security Concepts | Privileged Mode

Container

OpenShift Security Context Constraints

Secret

https://docs.docker.com/engine/swarm/secrets/