Secure Substrate: Least Privilege Container Deployment
•
6 likes•11,588 views
Riyaz Faizullabhoy - Security Engineer, Docker Diogo Mónica - Security Lead, Docker The popularity of containers has driven the need for distributed systems that can provide a substrate for container deployments. These systems need the ability to provision and manage resources, place workloads, and adapt in the presence of failures. In particular, container orchestrators make it easy for anyone to manage their container workloads using their cloud-based or on-premise infrastructure. Unfortunately, most of these systems have not been architected with security in mind.Compromise of a less-privileged node can allow an attacker to escalate privileges to either gain control of the whole system, or to access resources it shouldn't have access to. In this talk, we will go over how Docker has been working to build secure blocks that allow you to run a least privilege infrastructure - where any participant of the system only has access to the resources that are strictly necessary for its legitimate purpose. No more, no less.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Secure Substrate: Least Privilege Container Deployment
Similar to Secure Substrate: Least Privilege Container Deployment (20)
More from Docker, Inc.
More from Docker, Inc. (20)
Recently uploaded
Recently uploaded (20)
Secure Substrate: Least Privilege Container Deployment
- 1. Diogo Mónica Security Lead, Docker Riyaz Faizullabhoy Security Engineer, Docker Secure Substrate: Least Privilege Container Deployment
- 10. Rolling Deploys infraKit infraKit OS OS create rem ove uptime: 1 week uptime: 3 minutes
- 11. linuxKit The most secure OS builder for your containers
- 14. Already in use by millions of users linuxKit
- 17. runC Lightweight universal container runtime
- 18. • Namespace Isolation • Cgroups runC PID Namespaces MNT IPC NET Cgroups … CPU BLKIO MEM PIDS …
- 20. Content Addressable Image Pulls containerD alpine@sha256:29d234… 29d234… Manifest 16df34… 6ec6e1…3e94f1… 200dc0… 50d932… Layer 1 Layer 3Layer 2 Layer 4 Layer N …
- 22. • SELinux & AppArmor • Capability Whitelist • Syscall Whitelist Docker
- 24. Cryptographic Name Resolution Notary latest da4f25c… stable 1b33e92… edge 9dfe47d…
- 25. • Threshold Signing • Survivable Key Compromise Notary DEPLOYSIGNSIGN
- 27. Secure Node Introduction swarmKit SWMTKN-1-mx8suomaom825bet6-cm6zts22rl4hly2 Known Prefix Token Version Hash of Root CA Random Secret
- 30. Secure Secret Distribution swarmKit Worker Manager Raft Store Worker Manager Raft Store Worker Manager Raft Store
- 31. Transparent Root Rotation swarmKit Worker Worker Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Add Remove Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Renew 1 2 34
- 32. Transparent Root Rotation swarmKit Worker Worker Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Add Remove Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Renew 1 2 34
- 33. Transparent Root Rotation swarmKit Worker Worker Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Add Remove Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Renew 1 2 34
- 34. Transparent Root Rotation swarmKit Worker Worker Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Worker Manager Certificate Authority Worker Worker TLS TLS TLS TLS Add Remove Worker Manager TLS Certificate Authority Worker TLS Worker TLS Worker TLS TLS Renew 1 2 34
- 35. Bringing it all together
- 36. Notary for Docker image name resolution
- 37. Notary for Docker image name resolution
- 39. swarmKit delivered Docker containers
- 40. swarmKit delivered Docker containers
- 42. infraKit for swarmKit Bootstrap
- 43. infraKit for swarmKit Bootstrap
- 44. Secure Node Cluster Introduction 1. Retrieve and validate Root CA Public key material. 2. Submit new CSR along with secret token. 3. Retrieve the signed certificate.
- 45. linuxKit as the base OS builder
- 46. linuxKit as the base OS builder
- 48. Notary for secure dependency resolution
- 49. Notary for secure dependency resolution
- 51. infraKit plus Notary for trusted OS Provisioning
- 52. infraKit plus Notary for trusted OS Provisioning
- 53. Cryptographically Verified Boot 4k dm-verity 4k 4k4k 4k 4k root_hash Notary infraKit linuxKit +
- 54. Layered runC, containerD, Docker Runtime
- 55. Layered runC, containerD, Docker Runtime
- 58. runC, containerD, Docker, swarmKit, Notary
- 59. runC, containerD, Docker, swarmKit, Notary
- 61. runC, containerD, Docker, swarmKit, Notary, infraKit, linuxKit
- 62. runC, containerD, Docker, swarmKit, Notary, infraKit, linuxKit
- 72. Thank you!