Docker Security

How can you secure a Docker container? #

Use Official Images: Use official Docker images from trusted sources
Minimize Attack Surface: Remove unnecessary packages and services from images (use Distroless images)
Regular Updates: Keep Docker and images updated with the latest security patches
Network Segmentation: Use Docker's network features to isolate containers
Container Hardening: Configure and enforce security policies (e.g., Docker Bench Security)
Image Scanning: Use tools like Docker Security Scanning or third-party scanners to detect vulnerabilities
Secrets Management: Use Docker Secrets or external vaults for managing sensitive information
Monitoring and Logging: Implement monitoring and logging to detect and respond to security incidents promptly
Run as Non-Root User: Limit security risks by not running containers as root
Limit Permissions: Reduce container permissions & Container capabilities

How can you run container as Non-Root User #

Avoid root user: Limit security risks by not running containers as root

FROM node:14

WORKDIR /usr/src/app

COPY package*.json ./

RUN npm install

COPY . .

# Create a non-root user and group
RUN groupadd -r appgroup && useradd -r -g appgroup -d /usr/src/app appuser

# Change ownership of the app directory
RUN chown -R appuser:appgroup /usr/src/app

# Switch to the non-root user
USER appuser

EXPOSE 3000

CMD ["node", "app.js"]

Create group: Set up a system group named appgroup
Create user: Add a system user named appuser
Assign user to group: Place appuser in the appgroup
Set home directory: Assign /usr/src/app as the home directory for appuser

How do you limit Docker Container permissions #

Security features: Use Docker options like --cap-drop to reduce container permissions
Drop all capabilities: --cap-drop=ALL removes all privileged operations
Add specific capability: --cap-add=NET_ADMIN allows network administrative tasks

Example command:

docker run --cap-drop=ALL --cap-add=NET_ADMIN myimage

# Example
docker run -d --cap-drop=ALL --cap-add=NET_ADMIN \
busybox sh -c "tail -f /dev/null"

How do you check the health of a container? #

Ensure Smooth Container Operations: Health check is crucial for maintaining the reliability and stability of your container

HEALTHCHECK Instruction: Add a health check in the Dockerfile to periodically test if the container is healthy Example:

# Define the health check
HEALTHCHECK --interval=30s --timeout=10s --retries=3 --start-period=5s \
CMD replace_with_your_command || exit 1

--interval=30s: Sets the time between consecutive health checks
- The container will perform a health check every 30 seconds
--timeout=10s: Specifies the maximum time allowed for the health check command to complete
- If the health check doesn't respond within 10 seconds, it's considered a failure
--retries=3: Determines the number of consecutive failures needed to consider the container as unhealthy
- After 3 failed health checks, Docker marks the container as unhealthy
--start-period=5s: Provides a grace period after container start before initiating health checks
- Docker waits for 5 seconds after the container starts before performing the first health check
CMD: The command to run for the health check. It should return a zero exit code if healthy, or a non-zero code if unhealthy
Note: Below are the three primary methods to check the health of a container
- HTTP Endpoint
- TCP Port
- Custom Script

HTTP Endpoint: This method involves sending an HTTP request to a specific endpoint within the container to verify if the web server or application is responding correctly

Example:

# Use an appropriate base image
FROM nginx:latest

# Define the health check
HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
  CMD curl --fail http://localhost:80/ || exit 1

# Expose port 80
EXPOSE 80

Build and Run the Container

# Build the image
docker build -t custom-nginx .

# Run the container
docker run -d \
  --name my-nginx \
  -p 80:80 \
  custom-nginx

# Check Container Health
docker inspect my-nginx | grep -i "status"
docker inspect my-nginx | jq -r '.[0].State.Status'

TCP Port: This method checks whether a specific TCP port is open and accepting connections, ensuring that the service within the container is listening correctly

Example:

# Use an appropriate base image
FROM postgres:latest

# Define the health check
HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
  CMD nc -z localhost 5432 || exit 1

# Expose port 5432
EXPOSE 5432

Build and Run the Container

# Build the image
docker build -t custom-postgres .

# Run the container
docker run -d \
  --name my-postgres \
  -e POSTGRES_USER=myuser \
  -e POSTGRES_PASSWORD=mypassword \
  -e POSTGRES_DB=mydatabase \
  -p 5432:5432 \
  custom-postgres

# Check Container Health
docker inspect my-postgres | grep -i "status"
docker inspect my-postgres | jq -r '.[0].State.Status'

# Verify PostgreSQL is Running
docker exec -it my-postgres psql -U myuser -d mydatabase

Custom Script: This method utilizes a custom script to perform more complex or specific health checks tailored to the application's logic within the container

healthcheck.sh: Custom Script

#!/bin/bash

# Example health check: Verify if the application process is running
if pgrep httpd > /dev/null; then
  exit 0
else
  exit 1
fi

Example:

# Use an appropriate base image
FROM httpd:latest

# Copy the custom health check script into the container
COPY healthcheck.sh /usr/local/bin/healthcheck.sh

# Update package lists before installing procps
RUN apt-get update && apt-get install -y procps

# Make the script executable
RUN chmod +x /usr/local/bin/healthcheck.sh

# Define the health check
HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
  CMD /usr/local/bin/healthcheck.sh

# Expose necessary ports
EXPOSE 8080

Build and Run the Container

# Build the image
docker build -t custom-apache .

# Run the container
docker run -d \
  --name my-apache \
  -p 80:80 \
  custom-apache

# Check Container Health
docker inspect custom-apache | grep -i "status"
docker inspect custom-apache | jq -r '.[0].State.Status'

Explain Docker Content Trust (DCT) and how it enhances container security? #

Docker Content Trust (DCT): security feature that lets you verify the integrity & publisher of image
Content Trust: Uses digital signatures to verify the integrity and authenticity of Docker images.
Image security: Ensures images are untampered and from a trusted source
Enabling DCT:
```
export DOCKER_CONTENT_TRUST=1
```
- DCT verifies the signature before pulling the image, ensuring it is trusted and not altered

List out some tools for Docker image vulnerability scanning #

There are several popular tools to scan Docker images for known security vulnerabilities:

Trivy (Aqua Security):
- Fast, easy-to-use, and supports scanning of OS packages, application dependencies, and Infrastructure as Code (IaC)
Clair:
- Open-source project by CoreOS that scans Docker images by comparing installed packages against known vulnerabilities
Anchore Engine;
- Open-source tool providing in-depth image inspection, vulnerability scanning, and policy enforcement
Snyk CLI
- Command-line tool that checks for vulnerabilities in Docker images, as well as in code dependencies

How can you scan Docker images with Trivy? #

Trivy is a simple yet powerful vulnerability scanner for containers It checks both operating system packages and software dependencies (like Python packages or Node.js modules)

Prerequisites: Trivy installed on your system

Basic Scan: To scan a Docker image, run:

trivy image <image_name>

# Example
# Pull an example image
docker pull nginx:latest

# Scan the nginx:latest image
trivy image nginx:latest

Output: Lists found vulnerabilities (e.g., CVE identifiers, severity levels, and potential fixes)

Detailed Scan Output: To get more comprehensive output, including detailed descriptions and references

trivy image --security-checks vuln,secret --format table nginx:latest

--security-checks vuln,secret: Scans for both vulnerabilities and secrets (e.g., API keys)
--format table: Displays the results in a table format

Discuss the steps to mitigate vulnerabilities found by Trivy #

After running a Trivy scan, you may see a list of vulnerabilities along with recommended fixes

Upgrade the Base Image:
- Use a more recent or stable base image (e.g., python:3.10-alpine) that has fewer known vulnerabilities
Apply Security Patches:
- Update OS packages (e.g., apt-get update && apt-get upgrade -y or apk update && apk upgrade)
Update Application Dependencies:
- Modify requirements.txt, package.json, or equivalent files to use newer, patched versions
- Run your dependency manager (pip, npm, yarn, etc.) to install the updated packages
Remove Unnecessary Packages:
- Uninstall or remove libraries not needed by your application to reduce the attack surface
Implement Security Best Practices:
- Use multi-stage builds to keep the final image lightweight
- Run as a non-root user to minimize privileges
- Store secrets outside the image (e.g., Docker Secrets or an external vault)
Rescan:
- After making changes, run Trivy again to confirm that vulnerabilities are resolved

On this page

How can you secure a Docker container? #

How can you run container as Non-Root User #

How do you limit Docker Container permissions #

How do you check the health of a container? #

Explain Docker Content Trust (DCT) and how it enhances container security? #

List out some tools for Docker image vulnerability scanning #

How can you scan Docker images with Trivy? #

Discuss the steps to mitigate vulnerabilities found by Trivy #