Docker Security Rahul Sharma. Our Problem Sandboxing user coding assessments : Compile / Run different languages Allow to extract result Control network.

Slides:

Advertisements

Similar presentations

Applications of Feather-Weight Virtual Machines (FVMs) Hadi Salimi Distributed Systems Lab, School of Computer Engineering, Iran University of Science.

Advertisements

AppSec USA 2014 Denver, Colorado Implications & Opportunities at the Bleeding Edge of DevOps Chris Swan, CTO

Lightweight virtual system mechanism Gao feng

KVM and Container Performance and Isolation Deep Dive.

Perl Practical Extraction and Report Language Senior Projects II Jeff Wilson.

Chapter 9 Building a Secure Operating System for Linux.

An overview of AppArmor Doug Stanley 07/17/2010 An overview of AppArmor.

Security Improvements in Linux Using Capabilities

Zap Steven Osman Dinesh Subhraveti Gong Su Jason Nieh A System for Migrating Computing Environments.

Linux Security Module (LSM) Framework By Hasari Tosun 11/30/2006.

Supporting ethtool with Linux Integration Service Open Source Technology Center Microsoft.

Android An open handset alliance project Janice Garcia September 18, 2008 MIS 304.

Linux Security.

MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration Chapter 7 Configuring File Services in Windows Server 2008.

Unix Presentation. What is an Operating System An operating system (OS) is a program that allows you to interact with the computer -- all of the software.

CS 153 Design of Operating Systems Spring 2015 Lecture 24: Android OS.

Usable Mandatory Integrity Protection for Operating Systems Authors: Ninghui Li, Ziqing Mao and Hong Chen “IEEE Symposium on Security and Privacy(SP’07)”

Linux Intrusion Detection/Defense System (LIDS) - Sowmya Ponugoti - Binita Mehta - Christopher James.

Appendix D: Microsoft.NET Framework Overview. Overview.NET Framework Architecture.NET Namespaces.

@2011 Mihail L. Sichitiu1 Android Introduction Platform Overview.

Understand Disk Types LESSON Windows Server Administration Fundamentals.

Linux Security LINUX SECURITY. Firewall Linux Security Internet Database Application Web Server Firewall.

Thank you #SPSTC sponsors! Who Am I? Haystax Technology.

Linux Capability Zutao Zhu 10/23/2009. Outline Question 2 Question 5 Question 6.

Computer Architecture And OpenStack 刘国辉 EasyStack Co-Founder & CTO.

Privilege separation in Condor Bruce Beckles University of Cambridge Computing Service.

First Venture into the Android World Chapter 1 Part 2.

Container Security Daniel J Walsh Consulting Engineer Blog: danwalsh.livejournal.com

1 Linux Security Module: General Security Support for the Linux Kernel Presented by Chao-Sheng Lin 2005/11/1.

1 Objectives Discuss File Services in Windows Server 2008 Install the Distributed File System in Windows Server 2008 Discuss and create shared file resources.

JAVA Ekapap Julnonyang When it was implemented? Developed by Sun Microsystems. The first public implementation was Java 1.0 in 1995 The language.

Securing Network Resources with NTFS Permissions.

Secure System Development Mechanisms CS460 Cyber Security Lab Spring 2010.

Security-Enhanced Linux Stephanie Stelling Center for Information Security Department of Computer Science University of Tulsa, Tulsa, OK

By: Collin Molnar. Overview  Intro to Android  Security basics  Android architecture  Application isolation  Application permissions  Physical access.

Containers vs Others Xen, VMware, etc. ● Emulation/paravirtualization ● Can run different OSs on the same box ● Lower density/scalability ● OS sprawl problem.

Safety measures in Linux Krzysztof Lichota

Virtualization which isn't LXC (Linux Containers) Dobrica Pavlinušić DORS/CLUC, Zagreb,

SE Linux Implementation Russell Coker. What is SE Linux? A system for Mandatory Access Control (MAC) based on the Linux Security Modules (LSM) framework.

OpenShift & SELinux Dan Walsh Twitter: #rhatdan

Document Upload The Document Upload feature enables districts and schools to upload documents for the state to view. The district can also view documents.

Enabling Containers for High-Performance Computing

Towards Access Control for Isolated Applications

application into a Flatpak

Security options for container implementations

What is Apertis? Apertis is a versatile open source infrastructure tailored to the automotive needs and fit for a wide variety of electronic devices.

Application Sandboxes

Linux Containers Overview & Roadmap

UBUNTU INSTALLATION

Running containers everywhere

CASE STUDY 1: Linux and Android

Containers and Virtualisation

AppArmor LSM Update Introduce self John Johansen.

AppArmor Update 2014 Linux Security Summit

AppArmor Update 2015 Linux Security Summit

Security Technologies in Commercial Products

Introduction to the Kernel and Device Drivers

Setting policies in kubernetes

An Introduction to Device Drivers

Agenda Intro Why use containers at all? Linux Kernel: a pop of history

Container technology. Let’s dive into the world of docker and kubernetes Bjarte Brandt, DevOps Architect TV2.

Privilege Separation in Condor

IS3440 Linux Security Unit 7 Securing the Linux Kernel

Information Security - 2

Linux Security Module (LSM) Framework

PRIME/GreenLight project Miguel Erazo

Building, Debugging & Deploying Containerized

Docker and Kubernetes Security in ONAP Pawel Pawlak Amy Zwarico

Presentation transcript:

Docker Security Rahul Sharma

Our Problem Sandboxing user coding assessments : Compile / Run different languages Allow to extract result Control network access(internet access) Control folder access

Linux Namespaces

 IPC  Network  Mount  PID  UTS  USER In v1 the user namespace is not enabled by default for support of older kernels where the user namespace feature is not fully implemented.

Linux Capabilities Capability Enabled CAP_NET_RAW1 CAP_NET_BIND_SERVICE1 CAP_AUDIT_WRITE1 CAP_DAC_OVERRIDE1 CAP_SETFCAP1 CAP_SETPCAP1 CAP_SETGID1 CAP_SETUID1 CAP_MKNOD1 CAP_CHOWN1 CAP_FOWNER1 CAP_FSETID1 CAP_KILL1 CAP_SYS_CHROOT1 CAP_NET_BROADCAST0 CAP_SYS_MODULE0 CAP_WAKE_ALARM0 CAP_BLOCK_SUSPE0

Linux Capabilities Capability Enabled CAP_SYS_RAWIO0 CAP_SYS_PACCT0 CAP_SYS_ADMIN0 CAP_SYS_NICE0 CAP_SYS_RESOURCE0 CAP_SYS_TIME0 CAP_SYS_TTY_CONFIG0 CAP_AUDIT_CONTROL0 CAP_MAC_OVERRIDE0 CAP_MAC_ADMIN0 CAP_NET_ADMIN0 CAP_SYSLOG0 CAP_DAC_READ_SEARCH0 CAP_LINUX_IMMUTABLE0 CAP_IPC_LOCK0 CAP_IPC_OWNER0 CAP_SYS_PTRACE0 CAP_SYS_BOOT0 CAP_LEASE0

Additional Security AppArmor SELinux GRSEC

The Approach --user --cap-drop NET_RAW --volume /candidate_code:/container_loc --cpuset --memory Add limits to docker.conf limit nproc limit nofile limit fsize

+ The Approach

Thank you !!! Blog : devlearnings.wordpress.com