We have used virtual servers or bare-metal servers to host applications before the arrival of docker. We don’t need to worry about much when it comes to securing these types of servers, because we only need to focus on the hosted server environment and the application.
But docker container security is complex than other server environments. Some major areas that need to be considered for docker container security and are,
- In your docker environment, there probably have multiple docker images, each hosting microservices. So there are also multiple instances of each docker image running at the same time. We need to monitor and secure that all docker images and instances separately at the same time.
- The docker daemon needs to be secured to keep the containers its hosts safe. The host server will be bare metal or virtual server.
- There is another layer to secure the docker containers that are hosting containers in the cloud like ECS.
- A chance of creating loopholes in the configuration profile either by default or by users activity.
- The data volumes or other storage systems that you have configured externally from your containers.
Ways to Secure Docker containers:
1 . Setting Resource Quotas
The resource quotas feature allows us to set the limit for memory and CPU resources that a container can use.
This feature will also help to keep the docker environment efficient and also prevents the container from dominating the system resources.
It improves security by protecting against malicious activities by limiting container resource usage.
2. Avoid running using root user
If you are running a container as a root user it will change the uid and gid according to the root user. Then it will not allow specific functions by using normal users to run the container.
Running a container as a root user will allow more access to the server or containers (depending on how you are running the containers). So it will be better to create the docker file by mentioning a specific user for that container.
3. Control groups
Control groups are used for resource accounting and limiting. It can control the share of memory, CPU, disk I/O and hence helps to prevent the system down by exhausting these resource usage by containers.
Also, control groups will prevent one container from accessing data and processes of another container.
4. Docker daemon attack prevention
Docker containers (and applications) running using docker implies the docker daemon. This docker daemon needs root privileges unless you use rootless privilege.
You need to use trusted users for running docker containers and docker daemon. Otherwise, Docker daemon supports a TCP socket that can enable remote control over the network. If you have enabled this feature, then it will allow unencrypted communication.
5. REST API Security
The docker REST API can be usually accessed via a UNIX socket. We have to set the firewall policies to restrict the docker REST API access. Because docker REST API access can expose over TCP socket. So we need to set appropriate firewall rules for limiting access inside the docker container.
6. Use built-in kernel features
Dockers work with existing built-in features such as SELinux and AppArmor. SELinux policies like features can improve docker security.
RHEL based systems come with SELinux feature default. We can enable the SELinux policy for docker containers by using the “–SELinux-enabled” flag.
Using docker containers than the VM or bare metal services has more advantages. But it is important to keep this docker container also.
We need to confirm the security measurements for setting the docker environment properly. If you need any assistance in securing the docker container, our DevOps experts are available at any time for you.
