« Previous 1 2 3
Dialing up security for Docker containers
Container Security
Conclusions
Docker containers are theoretically less secure than VM systems such as KVM.
Steps such as using TLS and MAC can help to lock down the Docker environment. Seccomp is also recommended if containers of several customers run on the same system.
Admins should also pay attention to permissions: Container documentation sometimes states that privileged mode is required. Similar to the unspeakable wget URL | sudo bash constructs, which are found all over on the web, this privileged mode requirement is often a sign of bad container design rather than technical necessity.
Last but not least, be sure you are using a reliable container image. It may be tempting to download and launch any old image from the Docker Hub, but you are running a risk if the image is out of date or if you can't verify exactly what is actually inside the image file.
Develop a suitable continuous integration/continuous delivery workflow and use it to build containers for your own requirements. At the very least, admins should only use images that come from trusted sources. In addition to increased security, this operating concept has the side effect of making container operations easier and friendlier.
If you spend some time and energy on addressing the security issues, you'll find that you can operate Docker containers quite securely.
Infos
- Client certificates for Docker: https://docs.docker.com/engine/security/https
- TinyCA: https://tinyca.alioth.debian.org
- Seccomp policy: https://docs.docker.com/engine/security/seccomp
- "Stop disabling SELinux": https://stopdisablingselinux.com/
- GitLab: https://about.gitlab.com/
The Author
Martin Gerhard Loschwitz is a Telekom Public Cloud Architect for T-Systems and primarily works on topics such as OpenStack, Ceph, and Kubernetes.
« Previous 1 2 3
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
Improving Docker security now and in the future
The focus for container solutions such as Docker is increasingly shifting to security. Some vulnerabilities have been addressed, with plans to take further steps in the future to secure container virtualization. -
Minifying container images with DockerSlim
DockerSlim minifies your Docker container images up to 30x and adds security, too. -
Securing the container environment
Implement a good, robust defense with an in-depth strategy of applying multiple layers of security to all components, including the human factor. -
Application virtualization with Docker
Half-lives of products are becoming shorter and shorter on today's virtualization market. This year, the buzz is all about Docker. -
Keeping Docker containers safe
Docker containers introduce serious security problems, but you can employ a number of methods to deploy them securely.