Discusses the issues surrounding container security and the principle philosophies to apply when designing a secure system. Specific advice and tips will be given on how to secure a container based system, including how to limit the privileges of containers and avoid common mistakes.

32. RUN groupadd -r user && useradd -r -g user user
USER user

34. FROM debian
RUN apt-get update && apt-get install -y curl
RUN curl http://sourcecode.com/file.tgz -o /file.tgz
RUN tar xzf /file.tgz && make
RUN rm /file.tgz

35. FROM debian
RUN apt-get update && apt-get install -y curl
RUN curl http://sourcecode.com/file.tgz -o /file.tgz
&& tar xzf /file.tgz && make
&& rm /file.tgz

36. # Copy github ssh key
COPY github_rsa /root/.ssh/id_rsa
...
# Remove ssh key
RUN rm /root/.ssh/id_rsa

37. $ docker run --read-only debian touch x
touch: cannot touch 'x': Read-only file system

38. $ docker run -v $(pwd)/secrets:/secrets:ro
debian touch /secrets/x
touch: cannot touch '/secrets/x': Read-only file system

39. $ docker run --cap-drop SETUID --cap-drop SETGID myimage
$ docker run --cap-drop ALL --cap-add ...

40. $ docker run -d myimage
$ docker run -d -c 512 myimage
$ docker run -d -c 512 myimage

41. $ docker run -m 512m myimage

43. $ docker run debian
find / -perm +6000 -type f -exec ls -ld {} ; 2> /dev/null
-rwsr-xr-x 1 root root 10248 Apr 15 00:02 /usr/lib/pt_chown
-rwxr-sr-x 1 root shadow 62272 Nov 20 2014 /usr/bin/chage
-rwsr-xr-x 1 root root 75376 Nov 20 2014 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 53616 Nov 20 2014 /usr/bin/chfn
...

44. FROM debian:wheezy
RUN find / -perm +6000 -type f -exec chmod a-s {} ;
|| true

45. $ docker build -t defanged-debian .
...
Successfully built 526744cf1bc1
$ docker run --rm defanged-debian
find / -perm +6000 -type f -exec ls -ld {} ;
2> /dev/null | wc -l
0
$

50. $ docker daemon --icc=false

55. $ sestatus | grep mode
Current mode: enforcing
$ mkdir data
$ echo "hello" > data/file
$ docker run -v $(pwd)/data:/data debian cat /data/file
cat: /data/file: Permission denied

56. $ ls --scontext data
unconfined_u:object_r:user_home_t:s0 file
$ chcon -Rt svirt_sandbox_file_t data
$ docker run -v $(pwd)/data:/data debian cat /data/file
hello

66. $ docker run -e API_TOKEN=MY_SECRET myimage

67. $ docker run -e API_TOKEN=MY_SECRET myimage

68. $ docker run -e API_TOKEN=MY_SECRET myimage

69. $ docker run -e API_TOKEN=MY_SECRET myimage

70. $ docker run -e API_TOKEN=MY_SECRET myimage

71. $ docker run -v /secretdir/keyfile:/keyfile:ro myimage
$ docker run --volumes-from my-secret-container myimage

72. $ docker run -v /secretdir/keyfile:/keyfile:ro myimage
$ docker run --volumes-from my-secret-container myimage