Checklist for container security - devsecops practices
Legacy apps | Cloud Native apps | Cloud Native Security |
---|---|---|
Discrete, infrequent releases | frequent releases, using CI/CD | Shifting left with automated testing |
Very little open source | Open source everywhere | SCA - Software composition analysis |
Proprietary software | Proprietary code, Open source, Third-party software | Software supply chain risk |
Persistent workloads | Ephemeral workloads. Ensure that your containers are stateless and immutable | Runtime controls that follow the workload |
Hypervisor or hardware isolation | Shared kernel, obscured OS | Enforce least privilege on each workload |
Permanent address | Orchestrated containers. Kubernetes creates DNS records for services and pods | Identity-based segmentation |
Vertical control of the stack | multi-cloud | Detecting cloud services misconfigurations (CSPM) |
Networking monitoring and threat detection tools were based on auditd, syslog, dead-disk forensics, and it used to get the full contents of network packets to disk "packet captures". Capturing packets sotes every packet in a network to disk and runs custom pattern matching on each packet to identify an attack. | Cloud native apps the traffic is encrypted. Packet captures are too costly and ineffective for cloud native environments. | Using eBPF programs, you collect the events in real time without disruption to the app. |
Table by Aqua Cloud Native Security Platform, more details download here
Figure by Container Security by Liz Rice
Checklist to build and secure the images across the following phases:
Figure by cncf/tag-security
Sign and verify images to mitigate a man in the middle (MITM) attack. Docker offers a Content Trust mechanism that allows you to cryptographically sign images using a private key. This guarantees the image, and its tags, have not been modified.
You can build the container images using Docker, Kaniko.
Package a single application per container. Small container images. Minimize the number of layers.
A well-designed multi-stage build contains only the minimal binary files and dependencies required for the final image, with no build tools or intermediate files. Optimize cache.
Do not use a UID below 10,000. For best security, always run your processes as a UID above 10,000. Remove setuid and setgid permissions from the images
--read-only
mode in docker, if it's possible.Pulling images by digest
docker images --digests
docker pull alpine@sha256:b7233dafbed64e3738630b69382a8b231726aa1014ccaabc1947c5308a8910a7
Enabled Security profiles: SELinux, AppArmor, Seccomp.
Static code analysis tool for Dockerfile like a linter. Detect misconfigurations
Container Security Scanners
Comparing the container scanners results:
More Material about build containers
Best configurations with ECR, ACR, Harbor, etc. Best practices.
There is no guarantee that the image you are pulling from the registry is trusted. It may unintentionally contain security vulnerabilities, or may have intentionally been replaced with an image compromised by attackers.
See the following container runtimes, there are three main types of container runtimes—low-level runtimes, high-level runtimes, and virtualized runtimes or sandboxed.
Enable detection of anomalous behaviour in applications.
Never make the daemon socket available for remote connections, unless you are using Docker’s encrypted HTTPS socket, which supports authentication.
Limit the usage of mount Docker socket in a container in an untrusted environment.
Do not run Docker images with an option that exposes the socket in the container.
-v /var/run/docker.sock://var/run/docker.sock
The Docker daemon socket is a Unix network socket that facilitates communication with the Docker API. By default, this socket is owned by the root user. If anyone else obtains access to the socket, they will have permissions equivalent to root access to the host.
Run Docker in Rootless Mode. docker context use rootless
Enable the user namespaces.
Enable Docker Content Trust. Docker. DOCKER_CONTENT_TRUST=1
. Docker Content Trust implements The Update Framework (TUF)
. Powered by Notary, an open-source TUF-client and server that can operate over arbitrary trusted collections of data.
Do not run Docker without the default seccomp profile: seccomp=unconfined
- Seccomp enabled by default. See the Docker profile here
- Hardening Docker and Kubernetes with seccomp
More Material about Docker Security
Risk:
Best practices:
Keep the host kernel patched to prevent a range of known vulnerabilities, many of which can result in container escape. Since the kernel is shared by the container and the host, the kernel exploits when an attacker manages to run on a container can directly affect the host.
Use CIS-Benchmark for the operating system.
Use secure computing (seccomp) to restrict host system call (syscall) access from containers.
Use Security-Enhanced Linux (SELinux) to further isolate containers.
Secrets are Digital credentials:
- passwords
- API keys & Tokens
- SSH keys
- Private certificates for secure communication, transmitting and receiving data (TLS, SSL, and so on)
- Private encryption keys for systems like PGP
- Database names or connection strings.
- Sensitive configuration settings (email address, usernames, debug flags, etc.)
Use a proper filesystem encryption technology for container storage
Use volume mounts to pass secrets to a container at runtime
Provide write/execute access only to the containers that need to modify the data in a specific host filesystem path
OPA to write controls like only allowing Read-only Root Filesystem access, listing allowed host filesystem paths to mount, and listing allowed Flex volume drivers.
Automatically scan container images for sensitive data such as credentials, tokens, SSH keys, TLS certificates, database names or connection strings and so on, before pushing them to a container registry (can be done locally and in CI).
Limit storage related syscalls and capabilities to prevent runtime privilege escalation.
Implement RBAC, or role-based access control. Every human or application only needs the minimum secrets required to operate, nothing more. Principle of Least Privilege.
Run audits regularly. Centralized audit trails are the key to knowing all the key security events.
Rotate secrets, a standard security practice.
Automatically create and store secrets
Open source tools:
Cloud Provider Key Management
Enterprise secrets vault:
Avoid privileged containers
• Root access to all devices • Ability to tamper with Linux security modules like AppArmor and SELinux • Ability to install a new instance of the Docker platform, using the host’s kernel capabilities, and run Docker within Docker.
To check if the container is running in privileged mode
docker inspect --format =’{{. HostConfig.Privileged}}’[container_id]
When a container is compromised, attackers may try to make use of the underlying host resources to perform malicious activity. Set memory and CPU usage limits to minimize the impact of breaches for resource-intensive containers.
docker run -d --name container-1 --cpuset-cpus 0 --cpu-shares 768 cpu-stress
Preventing a fork bomb. docker run --rm -it --pids-limit 200 debian:jessie
Segregate container networks.
Improve container isolation.
Protecting a container is exactly the same as protecting any process running on Linux. Ideally, the operating system on a container host should protect the host kernel from container escapes, and prevent mutual influence between containers.
This can prevent malicious activity such as deploying malware on the container or modifying configuration.
docker run --read-only alpine
If you find any typos, errors, outdated resources; or if you have a different point of view. Please open a pull request or contact me.
Pull requests and stars are always welcome 🙌