Docker Security Guidelines

Transcript

1. Overcome The Security Hurdle In Your Docker Environment Tamar Twena-Stern
2. Tamar Twena-Stern • Software Engineer - manager and architect • Working at XM Cyber • Was a CTO of my own startup • Passionate about Node.js ! • Twitter: @SternTwena
3. Tamar Twena-Stern • Just Finished My Maternity Leave • Have 3 kids • Loves to play my violin • Javascript Israel community leader
4. Agenda • Quick Introduction to Docker • Docker resource management and how they can be used to attack your Docker environment • Defend your Docker Secrets • Container privileges • Reliable images
5. Intro To Linux Containers
6. What Is Docker ? • Popular open source project based on linux containers • Docker is a container engine that uses Linux Kernel features to • Create containers on top of operating system • Automate application deployment to container • Provide lightweight environment to run your application code.
7. Demo - A Simple Dockerized Server
8. Denial Of Service Attack
9. Docker Microservices Environment Microservice A Microservice B Microservice C
10. Now, Lets Bombard The Dockerized Service With Some Load
11. Docker CPU Access • By default, each container’s access to the host machine’s CPU cycles and memory is unlimited. • One container can consume the entire CPU or memory of the machine it is Running on
12. When One Container Consuming All CPU Resources Microservice A Microservice B Microservice C
13. Denial Of Service • Container can consume the whole CPU or memory of the host machine. • For example : When no available memory , linux kernel will throw out of memory exception and kill other processes • Whole system can crash • Attackers will use this knowledge to bring down your apps down • All the containers can crash
14. Mitigation - Restrict Resources For Your Containers • Limit CPU and Memory on all of your containers • A container that runs out of resources will shut down. • Isolation protects all of your other containers to shut down
15. When limiting resources Microservice A Microservice B Microservice C
16. Mitigation : Use Docker Flags On Container Run To Restrict CPU And Memory • From the command line use the following flags : • -m to restrict memory • -cpu to determine how much cpu your container will use docker run -p 49160:8080 -d tamatwe/unlimited_server_cpu -m 0.5 -cpu 0.5
17. Mitigation : Restrict CPU And Memory In Docker Compose File version: "3.7" services: redis: image: redis:alpine deploy: resources: limits: cpus: '0.50' memory: 50M reservations: cpus: '0.25' memory: 20M
18. Defend Your Secrets
19. Secrets As Files In The Image • A lot of time we are using secrets inside our applications • We usually store the secrets in files • Password • SSL certificate • SSH private key • TLS certificates and keys • When we build a Dockerfile , in that case , by using COPY or ADD we copy the requested secrets into our docker image.
20. Demo - Getting A Secret File From A Docker Image
21. Never Store A Secret In A File Inside Your Container • 2 easy steps to get your secret : • Pull the image • Run Exec to get the file from container
22. Can I Delete The File After Copy ? COPY my_secret.txt . // Do logic with your secret RUN rm -rf my_secret.txt
23. Docker Layering Model Layer 1 Layer 2 My Layer (N) . . .
24. Docker Caching Layer • To Optimise build process - docker use caching • Caching layer works on RUN, COPY and ADD commands Warning - Even if deleted, file can be fetched from caching layer !
25. Demo - Should We Store The Secret In Env Variable ?
26. • 2 easy steps to get your secret : • Pull the image • Run docker INSPECT and get all info about env variables Never Store A Secret In An Env Variable
27. So, How Do I Defend My Secrets ?
28. Mitigation - Use Multi Staged Builds • Use Multiple FROM statements in your Dockerfile • Each can use a different base • Each begins new stage of the build • Fetch and manage secrets in an intermediate image layer that is later disposed of so that no sensitive data • reaches the image build • Held in cache
29. Mitigation - Multi Staged Build FROM: ubuntu as intermediate WORKDIR /app COPY secret/key /tmp/ RUN scp -i /tmp/key build@acme/files . FROM ubuntu WORKDIR /app COPY --from intermediate /app .
30. Mitigation 2 - Use Docker Secrets • Docker secrets are available only when using Docker Swarm, or when using docker compose. • Docker secret is stored as a blob of data • Use Docker secrets to centrally manage this data and securely • A secret is only accessible to those services which have been granted explicit access to it, and only while those service tasks are running
31. Docker Secrets - Example
32. Limit Container Privileges
33. • By default, a docker container is running as root. • It is easier to the attacker to gain access to sensitive information and to your kernel. Default Docker Container Privileges - Running As Root
34. Lets Understand Why Running As Root Is Not Ideal By Using Volumes To Store Sensitive Data
35. Intro To Docker Volumes • Gives the ability to share data between containers and the host machine • Can be defined by : • -v flag on run command • docker-compose • Volumes are directories that are • Outside the default union files • Exist as normal directories and files in the host file system
36. • Many recommend to use Docker Volumes to store sensitive data • Pro - • This is helping by making them not visible in docker inspect command • Cons - • If they are stored in Volumes - by default , when Docker container runs as root, those secrets can be accessed • By accessing the volumes, files from the host machine can be reachable too Docker Volumes For Storing Sensitive Data
37. Demo - Expose /etc/shadow Of The Host By Accessing Volume On A Container Runs As Root
38. Mitigation - Setting Container User By Using Docker Flags • Use -u flag to specify user : • docker run -u 1000 <IMAGE_PARAMS> • in linux 0-499 are reserved users. Use a user above 500 to avoid running as system user.
39. Mitigation 2 - Setting Container User In Dockerfile
40. Mitigation 3 - Limit Docker Capabilities • —cap-drop - Drop Docker container capabilities • —cap-add - Add Docker container capabilities • Don’t use —privileged - • Give all linux kernel capabilities to the container
41. Use Reliable Images
42. Using A Docker Image • Docker layering model makes it such that images are built in layers • Each image has several parents that it takes its functionality from them • You always base your image on other image that you pulled from Docker hub • You can pull an image that has vulnerabilities, exploits and other malicious components.
43. Mitigation - Disable Pulling Unsigned Images By Using Docker Content Trust
44. Docker Images Usages - Guidelines • Use Only Images From trusted sources • Use minimal Images - avoid any unnecessary additions • Always keep your docker images up to date
45. Questions ?
46. • Twitter: @SternTwena • Mail : tamar.twena@gmail.com • Up next : • NodeTLV - 3.3.2019 • IJS London - 20.4.2019