Hacker News Reader

Comment by bliti | Hacker News Reader

Since Docker is not ready to officially be used in production:

- Those of you using it in production, how are you handling security?

- How secure has Docker proven to be in general?

Containers per se do not reduce security. Most of the security issues are related to other changes, eg if you switch from VMs to Docker you are removing the VMs that may have been providing security, thats not really a Docker issue per se. If you run stuff with increased privileges in containers (ie root, or some capabilities) then you may decrease security too, but your applications should not be doing this.

You can argue that the docker daemon itself (which is a big monolithic process running as root) is a security issue (RedHat certainly do). You can also argue that it makes security processes harder, as you dont have workflows in place to audit containers, make sure they are updated etc, but thats a different issue.

Eeehhh, I'm going to go out on a limb and say that Docker containers, as of 1.6, do reduce security. Without user namespaces, container root is system root, and the number of images that run as container root is incredibly high (where they might otherwise be running as system non-root). 1.7 should change this, as we'll finally get user namespaces, though I don't know how many people will end up using them; let's hope they're on by default, I guess.

But if you run stuff as root you already lost, container or not. Why are so many people running containers as root? Is it because they are running whole distros that expect that?

User namespaces are going to be really complicated to work with not really convinced they are the panacea people expect. Not running as root is much easier!

Sure. I'm just saying that running stuff as root is the de-facto standard in the container world; it isn't outside of the docker ecosystem. Take, for example, the docker registry image[0]. Runs as root. In what world, other than the docker world, would that be considered acceptable?

[0] https://github.com/docker/docker-registry/blob/0.9.1/Dockerf...

By your logic that means all operating systems are insecure because users can run things as root. I've grown tired of hearing this argument against containers (not just Docker). It applies to security in general.

The container root certainly has UID 0, but it has reduced system capabilities. The irony of user namespaces is that they provide additional capabilities, but give you a fake UID-0 while "actually" running as a higher UID.

This distinction is important because it's why, in practice, Docker's current approach has proven to be more secure than user namespaces. User namespaces allow various operations that would be outright denied under a Docker container's very-real-but-very-limited root user.

However, yes, user namespaces are coming to Docker. It's a highly desired feature and eventually userns will mature.

I'd be interested to see how the current approach has been proven to be more secure than userns, though I can well beleive it. I do agree that dropping capabilities is good, however, even with the reduced capabilities provided, the kernel is still a very large target, and so I would sleep a lot easier with userns active (in addition to capability (and mb even seccomp ;)) filtering) on all my containers. It just seems like such a free win (and I appreciate how that must sound to the people who are implementing it).

Related discussion from Daniel Walsh at Redhat on security in Docker: https://www.youtube.com/watch?v=zWGFqMuEHdw

>How secure has Docker proven to be in general?

Very little compared to hardware-assisted virtualization like KVM. Unfortunately LXC containers are not designed with security in mind and, together with the rest of the kernel, provide a big attack surface.

Other than privilege escalation through the kernel, what attack surface do you see exposed?

Might just be limited to my use case for Docker, but so far it's security agnostic.

We are using docker in production. We have had many issues but none related to security.

It's an interesting phrase: 'to officially be used in production'. Who is the official that officially signs docker to be ready? ;-)

Well, Docker Inc called Docker production ready on the 1.0 release and took down all the "do not use in production" warnings.

What are your security concerns regarding Docker? Or what do you perceive to be common security flaws?

So far I've perceived Docker to be like virtualenv for python - useful but orthogonal to any security practices.

Reply on news.ycombinator.com