My talk today at Container World 2017 conference (Santa Clara Convention Center, CA)

1. How secure is your container pipeline?
Manideep Konakandla
www.manideepk.com (@manideep_k1)
Feb 22, 2017

2. 2
Who am I? Hmm, yeah - Shameless Bragging
• J.N Tata Scholar, ISC2 Scholar, RSA Conference Security Scholar etc.
• Masters Student (Graduating in May’17) + Security Researcher at CMU
• Authored a book on Info Sec & Ethical Hacking at the age of 21
• Featured in INDIA’s largest news papers and news channels
• 10 certifications + Trained 15,000+ people in Information Security
• Ex “Team Lead – Core Security & Data Analytics” at TCS
• Interest areas : Container Security, Application Security, System Security etc.
More details about me on www.manideepk.com

3. 3
What am I up to with Containers?
• Co-author, Contributor for CIS Docker 1.12 & 1.13 benchmarks
• Extensive research at Carnegie Mellon (CMU)
• Presented findings at OWASP AppsecUSA, Bsides SF, RSA (Poster), Grehack etc.
• Cloud Security Research Intern @Adobe last Summer

4. 4
Security skills can be taught
but
Security mindset comes only with passion

5. 5
Before we start

6. 6
What are we doing for next 40 mins?
 A.B.C.D….
• Containers in 45 seconds
• Container Pipeline, Risk Areas and our Scope
 Security
• Images
• Runtime
• Other components
• Enterprise zone
 Misc.
 Wrap up

7. 7
What are we doing for next 40 mins?
 A.B.C.D….
• Containers in 45 seconds
• Container Pipeline, Risk Areas and our Scope
 Security
• Images
• Runtime
• Other components
• Enterprise zone
 Misc.
 Wrap up

8. 8
Quick “60 second” Intro
Containers?
 Lightweight
 Application centric
 No more - “it works on my machine”
 Micro-services
Namespaces : Isolation (PID, User, Network, IPC,
Mount, UTS)
Cgroups : Isolates, limits and accounts resource
usage (CPU, memory etc.)
BUZZ……….!
Are containers
brand new?
Img Ref: www.docker.com
Containers in 45 seconds

9. 9
Client <=> daemon
communication
Communication with public/private registry
Registry’s security
Host security Daemon security
Containers Images
Container Pipeline, Risk Areas and our Scope
Ref: Modified version of image on www.docker.com

10. 10
What’s next?
 A.B.C.D….
• Containers in 45 seconds
• Container Pipeline, Risk Areas and our Scope
 Security
• Images
• Runtime
• Other components
• Enterprise zone
 Misc.
 Wrap up

11. 11
Client <=> daemon
communication
Communication with public/private registry
Registry’s security
Host security Daemon security
Containers Images
Container Pipeline, Risk Areas and our Scope
Ref: Modified version of image on www.docker.com

12. 12
Life cycle of an “Image”
Build Spin
Dockerfile Image Container
Maintaining images

13. 13
Security in “Dockerfile” - Golden Rules
• Do not write secrets in Dockerfile (Info Disclosure - Twitter’s Vine). Use secret
management solutions
• Create a USER or else container will run as a root (Privilege escalation)
• Follow version pinning for images, packages (no ‘latest’) etc. (Caching Issue)
• Remove unnecessary setuid, setgid permissions (Privilege escalation)
• Download packages securely using GPG (MITM) and also do not download
unnecessary packages (Increased attack surface)
• Do not write any kind of update instructions alone in the Dockerfile (Caching)
• Use COPY instead of ADD (Increased attack surface)
• Use HEALTHCHECK command (Best practice)
• Use gosu instead of sudo wherever possible
• Try to restrict a image (/container) to one service

14. 14
Building Images

15. 15
Maintaining/ Consuming Images - Golden Rules
• Docker Content Trust
- Provides authenticity, integrity and freshness guarantees
- Takes some time to understand & prepare your own setup (worth it!)
• Vulnerability–free Images
- Tool selection : binary level analysis + hash based
• Except compatibility issues, all images and packages must be up-to-date

16. 16
Client <=> daemon
communication
Communication with public/private registry
Registry’s security
Host security Daemon security
Containers Images
Container Pipeline, Risk Areas and our Scope
Ref: Modified version of image on www.docker.com

17. 17
Container Runtime - Golden Rules
• Do not disable/misconfigure seccomp, apparmor/selinux, capabilities
• Change the default memory limits, CPU shares (else DOS)
• Do not use default docker0 bridge (ARP spoofing, MITM etc.)
• Enable PIDs cgroup per container (fork bomb)
• Do not use privileged containers and try to set no new privileges flag (priv. issues)
• Beware of non namespaced components : kernel keyring etc. (Container breakout)
• Bind incoming traffic to any specific interface (Info disclosure etc.)
• Do not share host’s namespaces to containers (Info disclosure etc.)
• Mounts (Violation of least privilege)
• Ensure Docker commands get latest images (Caching issue)

18. 18
Client <=> daemon
communication
Communication with public/private registry
Registry’s security
Host security Daemon security
Containers Images
Container Pipeline, Risk Areas and our Scope
Ref: Modified version of image on www.docker.com

19. 19
Other components - Golden Rules
• Daemon Security
- Fix dangerous defaults such as allowing communication between containers
- Enable/use/implement much needed security controls (user namespaces,
ulimits, authorization plugins, restricting daemon access)
• Communication Security
• Registry’s Security (Did not explore specifically)
• Host Security
- Maintain latest Linux kernel (PIDs cgroup only in > 4.3) and Docker version
- Apply kernel hardening policies (GRSecurity, PaX etc.)
- Harden the host as per CIS / SANS / your custom hardening guidelines

20. 20
Enterprise zone (Personal users ALLOWED!)
• Images
- Say “no” to Docker Hub (definitely not general images)
- Maintain your own in-house registries (What security controls?)
- Base image selection and also using image optimization techniques
• Runtime
- Customize seccomp, apparmor/selinux etc. profiles
• Misc.
- Create container specific standards and guidelines
- Use commercial tools (useful features like Image Lockdown, RBAC, profiling,
monitoring, anomaly detection, secret management etc.)
- Customize CIS Docker benchmarks as per your requirements and adhere to it
- Use file monitoring solutions
- Container specific SIEM rules
- Group containers on VM’s (categories?)
- Your general security controls 

21. 21
Client <=> daemon
communication
Communication with public/private registry
Registry’s security
Host security Daemon security
Containers Images
Container Pipeline, Risk Areas and our Scope
Ref: Modified version of image on www.docker.com

22. 22
 A.B.C.D….
• Containers in 45 seconds
• Container Pipeline, Risk Areas and our Scope
 Security
• Images
• Runtime
• Other components
• Enterprise zone
 Misc.
 Wrap up
What’s next?

23. 23
Misc.
• Tool recommendations (Meet me!)
- Images
- Network level
- Container Ecosystem
• Hardware isolation to containers (Clear containers – are they really containers?)
• Future expectation of containers (My 2¢)
• Virtual machines security to containers (view of kernel)

24. 24
What’s next?
 A.B.C.D….
• Containers in 45 seconds
• Container Pipeline, Risk Areas and our Scope
 Security
• Images
• Runtime
• Other components
• Enterprise zone
 Misc.
 Wrap up

25. 25
So, what did you learn today?

26. 26
It’s not good to keep questions in your mind
Throw them out and I am here to catch 

27. 27
References
1. CIS Docker Benchmarks - 1.12 and 1.13
2. https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/2016/april/ncc_group_understanding_hardening_linux_containers-1-1pdf
3. www.oreilly.com/webops-perf/free/files/docker-security.pdf
4. http://container-solutions.com/content/uploads/2015/06/15.06.15_DockerCheatSheet_A2.pdf
5. http://www.slideshare.net/Docker/docker-security-workshop-slides
6. http://www.slideshare.net/Docker/securing-the-container-pipeline-at-salesforce-by-cem-gurkok-63493231
7. https://docs.docker.com/engine/security/
8. http://www.slideshare.net/Docker/docker-security-deep-dive-by-ying-li-and-david-lawrence

28. 28TCS Confidential
That’s it…!
You can collect my V-Card
Reach me on www.manideepk.com for any questions