AI Insights
Showing results for 
Search instead for 
Did you mean: 

Docker offers solutions for the top security risks in container technology


By: Eric J. Bruno

Containers are rising in popularity and for good reason. Container solutions such as Docker help to automate and control the deployment of software assets within an operating system and server environment. They provide the consistency, portability, and agility needed for both DevOps and cloud deployments. But with these benefits come container security concerns you need to tackle.

Docker solutionsThe foremost concern is that while containers provide isolation and resource restrictions, they do so through namespaces, not through full sandboxing. This can lead to some serious security issues for those who assume they're safe and don't take proper safeguards. As a result, container solutions such as Docker have taken steps to harden container security. First, let's examine some of the issues.

Potential security issues with containers

Unfortunately, many people assume that the use of containers—and Linux in general—is enough to protect you from malware. That's not the case. Here are some of the potential security issues with containers that you and your IT team should be aware of:

  • Downloading and running random containers: Developers like to share and explore, and this collaboration is generally a good thing. However, this opens your internal systems to vulnerabilities if a container image downloaded from an untrusted, unknown, or untested source contains malware—intentional or not.
  • Namespaces aren't sandboxes: Containers are based on Linux namespaces to control an application's view of the system. This includes the process list and the network subsystem, including the local system's hostname, memory, and the file system. Unlike a Linux virtual machine, processes within a container often have direct access to the kernel and not all services are protected by a namespace.
  • Taking security shortcuts: Containers allow you to stand up software quickly, which is part of their value. But sometimes "quickly" becomes "hasty," as security assumptions lead people to take shortcuts (for example, running everything within a container as the root user).
  • Lack of container governance: Allowing developers to upload and run unchecked containers into shared production systems puts everyone at risk, including your developers, other systems, and ultimately your users. Lack of process and review is just as risky for container implementations.
  • Lack of a container maintenance plan: With their ease of use, containers can proliferate throughout your infrastructure. Without proper tracking and maintenance, the software packages within each container can become out of date, missing critical security patches or upgrades.

Implementing secure containers

While some of the security risks listed above can be resolved with improved processes and control, others cannot. Fortunately, container solutions vendors are working to improve the security of container technology.

Meanwhile, there are some container security best practices you can implement on your own:

  • Treat processes within a container as though they're running outside the container.
  • Don't run software or scripts as root within a container.
  • Create a trusted repository for container images.
  • Appoint a container security team within IT to manage and patch running container instances.

Additionally, Docker has implemented features to improve inherent container security. These include:

  • The Docker Content Trust: A built-in, signed Docker container implementation, where you can configure servers to run only signed, trusted images. Based on public key infrastructure (PKI), the implementation allows you to securely control who signs imagesandwhere they can run.
  • The Docker Registry: A secure image repository that makes it quick and easy to pull trusted container images through a managed API.
  • Docker plumbing improvement: Separating the "plumbing" infrastructure from the internal Docker implementation is helping to create a more modular implementation for container users. This approach not only helps make container use easier for IT operations to manage but also leads to a more robust and secure container infrastructure rollout.
  • The universal container runtime (runC): Docker has been working to sandbox and abstract containers further within the host system. The low-level runC component is a lightweight and portable container runtime that encapsulates all of Docker's plumbing, has been built for production use, and—most importantly—has been designed with improved security in mind.

Perhaps the largest security benefit of containers is that they help you control and identify the attack surfaces of the software running within them. Running a secure and hardened container host is your first step in defending against vulnerabilities, arguably in a more controlled manner than running a bunch of opaque processes on a single host OS. Further, through the use of Multi-Category Security (MCS), a server administrator can set policies per container that control container-to-host interactions, including restricting meta-operations, such as database connections, restricting ports, read-only mounting, and so on.

With some common sense, a healthy dose of reasonable security policies, and help from your container solutions vendor, you can build a modern, robust, agile, and secure deployment platform for your entire organization.

0 Kudos
About the Author