Breaking Out of Docker via RunC
twistlock.com
Breaking Out of Docker via RunC
1–10 of 21 posts
Re: Breaking Out of Docker via RunC
#2Are those diagrams generated via something or did you create it in an app?
Re: Breaking Out of Docker via RunC
#3why isn't docker and k8s banned by security teams? these are clearly broken abstractions that would violate most security audits immediately
Re: Breaking Out of Docker via RunC
#4Are those diagrams generated via something or did you create it in an app?
They're created using https://www.draw.io/
Re: Breaking Out of Docker via RunC
#5why isn't docker and k8s banned by security teams? these are clearly broken abstractions that would violate most security audits immediately
We think of these as deployment abstractions that provide no security value. This is why services like Amazon’s ECS Fargate pair 1 task definition (usually a single container) to a single EC2 host for isolation.
Re: Breaking Out of Docker via RunC
#6This is a really great exploration of this vulnerability.
It makes me sad that lxc doesn't get more love. LXC has had unprivileged containers as its default for 5+ years now. Its a really solid tool set that has mostly been passed over for lack of marketing.
Re: Breaking Out of Docker via RunC
#7why isn't docker and k8s banned by security teams? these are clearly broken abstractions that would violate most security audits immediately
Because the abstractions are good and the implementation gets better over time as with any other software. Obviously truly sensitive data should be handled on separate physical nodes (defense in depth).
Re: Breaking Out of Docker via RunC
#8A post by Christian Brauner (LXC/LXD developer) on how LXC and LXD are affected.
In summary, unprivileged containers (as found in LXD) are not affected.
https://brauner.github.io/2019/02/12/privileged-containers.h...
Re: Breaking Out of Docker via RunC
#9This is very interesting, because most docker break outs I see are exploits in the linux kernel, but this is one of the few in the containerization components themselves (first one I remember in runC).
Re: Breaking Out of Docker via RunC
#10This is a really great exploration of this vulnerability. It makes me sad that lxc doesn't get more love. LXC has had unprivileged containers as its default for 5+ years now. Its a really solid tool set that has mostly been passed over for lack of marketing.
The reason Docker gets so much attention is its container image repository infrastructure. I'm sure LXC has something similar, but Docker's is built-in and has almost anything you can think of. (Of course, this presents other security/trust issues).