The document discusses container security, providing advantages and disadvantages of containers as well as threats. It outlines different approaches to container security including host-based methods using namespaces, control groups, and capabilities as well as container-based scanning and digital signatures. Third-party security tools are also mentioned. The document concludes with examples of using containers for microservices and network policies for protection.

1. What You Should Know About
Container Security
DeveloperWeek Austin
November 8, 2017
Anthony Chow
Auth0 Ambassador
Twitter: @vCloudernBeer
Blog: http://cloudn1n3.blogspot.com/

2.  Small footprint
 Self contained
 Fast provisioning time
 Docker: Build – Ship - Run
 Useful tool for DevOps
 Effective solution for Microservices
Advantages of Containers

3.  Not easy with persistent storage
 Less isolated than a Virtual Machine
 Share the same OS Kernel
 Networking solutions to provide isolation
Disadvantages of Container

4.  Escape
 Cross-container attacks
 Application vulnerabilities
 Denial of Service attack on the host.
Types of Threads to Containers

5.  Host based
 Container based
 3rd Party Security Offerings
 Miscellaneous
Different ways of looking into
Container Security

6.  Namespace
 Control group (cgroup)
 Root capabilities
 Linux Security Modules (LSM)
Host based container security

7. Image source: https://image.slidesharecdn.com/linuxcontainersnextgenvirtualizationforcloudatlsummitar4-3-copy-140514133120-phpapp02/95/linux-containers-next-
gen-virtualization-for-cloud-atl-summit-ar4-3-copy-11-638.jpg?cb=1400074471

8.  Not turned on by default in Docker
 Docker daemon needs to be started with “–userns-
remap=default”
User Namespace

9. Image source: https://image.slidesharecdn.com/linuxcontainersnextgenvirtualizationforcloudatlsummitar4-3-copy-140514133120-phpapp02/95/linux-containers-next-
gen-virtualization-for-cloud-atl-summit-ar4-3-copy-6-638.jpg?cb=1400074471

10.  Fine grain control over ‘root’ privileges
 /usr/include/linux/capability.h
 sudo /sbin/capsh –-print
 https://linux.die.net/man/7/capabilities
 docker run -ti --name ubuntu1 --cap-drop=net_raw ubuntu
bash
 RedHat uses SystemTap to find capabilities of a container
(https://developers.redhat.com/blog/2017/02/16/find-what-capabilities-an-application-requires-to-successful-run-in-a-container/)
 https://docs.docker.com/engine/security/seccomp/
Root Capabilities

11.  Discretionary Access Control
 the owner of the object specifies which subjects can access the
object
 Mandatory Access Control
 the system (and not the users) specifies which subjects can
access specific data objects
 Role Based Access Control
 Access is based on permission associated with a role and user is
assigned with different roles.
 Rule Based Access Control
 Access is allowed or denied to resource objects based on a set of
rules defined by a system administrator
Access Control Types

12.  https://www.cyberciti.biz/tips/selinux-vs-apparmor-vs-grsecurity.html
 SELinux
 3 modes: Enforcing, Permissive and disabled
 http://www.projectatomic.io/docs/docker-and-selinux/
 https://opensource.com/business/14/9/security-for-docker
 Works with labels.
 AppArmor
 2 modes: Enforcement and Complain
 https://docs.docker.com/engine/security/apparmor/
 Works with file path.
Linux Security Module (LSM)

13.  Digital Digest for container image integrity
 Docker Content Trust
 CoreOS – dm_verify
 Registry Authentication
 OAuth2
 Keyclock
 Container Scanning
 IBM – Vulnerability Advisor
 RedHat – Atomic host
 CoreOS – Clair and Quary
 Docker – Docker cloud and Docker Hub
Container based security

14. Image source: http://cdn.ttgtmedia.com/rms/onlineImages/ss_digitalsignature_2014_v01_desktop.png

15. Image source: http://wiki.snom.com/wiki/images/thumb/0/05/M9_custom_cert.PNG/800px-M9_custom_cert.PNG

16.  Aqua - https://www.aquasec.com/
 Anchore - https://github.com/anchore/anchore
 TwistLock - https://www.twistlock.com/
 Tenable - http://www.tenable.com/
 Blackduck -https://www.blackducksoftware.com/
 StackRox - stackrox.com
3rd Party Security Offerings

17.  Aqua - https://www.aquasec.com/
 Anchore - https://github.com/anchore/anchore
 TwistLock - https://www.twistlock.com/
 Tenable - http://www.tenable.com/
 Blackduck -https://www.blackducksoftware.com/
 StackRox - stackrox.com
3rd Party Security Offerings

18.  Open Container Initiative (OCI)
 Hardware Assisted:
 Intel Clear Container
 SCONE - Secure Linux Containers on Intel SGX
 LinuxKit
 Docker 1.13 Secret Management
 Docker Authentication with Keycloak
 Linux Container Hardening
Miscellaneous

19.  QEMU-light
 DAX – Direct Access
 KSM – Kernel Same-page Mapping
Intel Clear Container core
technologies

20. Intel Clear Container – a
container run timeimage source: https://github.com/clearcontainers/runtime/blob/master/docs/architecture/architecture.md

21. Intel Clear Container ArchitectureImage Source: https://clearlinux.org/documentation/clear-containers/architecture-overview.html

23. onboot:
- name: dhcpcd
image: linuxkit/dhcpcd:<hash>
command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
- name: wg
image: linuxkit/ip:<hash>
net: new
binds:
- /etc/wireguard:/etc/wireguard
command: ["sh", "-c", "ip link set dev wg0 up; ip address add dev wg0 192.168.2.1 peer 192.168.2.2; wg setconf wg0 /etc/wireguard/wg0.conf; wg show wg0"]
runtime:
interfaces:
- name: wg0
add: wireguard
createInRoot: true
bindNS:
net: /run/netns/wg
services:
- name: nginx
image: nginx:alpine
net: /run/netns/wg
capabilities:
- CAP_NET_BIND_SERVICE
- CAP_CHOWN
- CAP_SETUID
- CAP_SETGID
- CAP_DAC_OVERRIDE

24.  OAuth2 for authentication and authorization
 Calico for security policy to protect east-west
traffic
Container Use case -
Microservices

25.  Resource Owner
 Resource Server
 Authorization Server
 Access Token
 Authorization Grant
OAuth2 Terminologies

26. OAuth2 in Microservicesimage source: https://dzone.com/articles/microservices-in-practice-1

27.  Frequent and short life span
 Increase East-West traffic
 Individual container/pod not isolated for
functionality
Microservices opens up Security
risk

28. cat << EOF | calicoctl create -f -
- apiVersion: v1
kind: policy
metadata:
name: frontend
spec:
order: 0
selector: role == 'frontend'
egress:
- action: allow
protocol: tcp
destination:
selector: role == 'database'
ports:
- 3306
Sample Calico network policy

29.  https://opensource.com/business/14/7/docker-security-
selinux
 https://docs.docker.com/engine/security/security/
 https://opensource.com/business/14/9/security-for-docker
 https://coreos.com/blog/verifying-os-at-runtime.html
 https://developers.redhat.com/blog/2017/10/31/docker-
authentication-keycloak/
Useful blog post on container
security

30. Thanks for coming and enjoy the rest of
DeveloperWeek Austin, 2017