OWasp Docker Security Cheat Sheet Flashcards
Real time AJAX security evaluation for learners based on content at https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet
RULE #0: Keep Host and Docker Up to Date
Why is keeping the host and Docker updated important?
Containers share the host’s kernel, so vulnerabilities like Dirty COW in the host kernel can result in root access on the host.
RULE #0: Keep Host and Docker Up to Date
What components should be regularly updated?
The host kernel and the Docker Engine.
RULE #1: Do Not Expose the Docker Daemon Socket
Why should the Docker daemon socket not be exposed?
The socket, /var/run/docker.sock, grants unrestricted root access to the host.
RULE #1: Do Not Expose the Docker Daemon Socket
What should you avoid enabling for Docker daemon socket?
Avoid enabling unencrypted and unauthenticated TCP access (-H tcp://0.0.0.0:XXX).
RULE #2: Set a User
How can privilege escalation attacks be prevented?
Configure containers to use unprivileged users during runtime or build time.
RULE #2: Set a User
What Kubernetes field is used to set a user for a Pod?
The runAsUser field in the SecurityContext.
RULE #3: Limit Capabilities
What is the safest way to configure Linux kernel capabilities for containers?
Drop all capabilities (–cap-drop all) and add only the required ones (–cap-add).
RULE #3: Limit Capabilities
Why should you not use the –privileged flag?
It adds all Linux kernel capabilities to the container, creating security risks.
ULE #4: Prevent In-Container Privilege Escalation
How can privilege escalation within a container be disabled?
Use the –security-opt=no-new-privileges option during runtime.
ULE #4: Prevent In-Container Privilege Escalation
What Kubernetes field prevents privilege escalation?
allowPrivilegeEscalation: false in the SecurityContext.
RULE #5: Be Mindful of Inter-Container Connectivity
How can inter-container communication be restricted in Docker?
Use custom Docker networks instead of relying on the default docker0 bridged network.
RULE #5: Be Mindful of Inter-Container Connectivity
What Kubernetes feature helps regulate pod interactions?
Network Policies.
RULE #6: Use Linux Security Modules
What security profiles should be considered for Docker containers?
Use Linux Security Modules such as seccomp, AppArmor, or SELinux.
RULE #6: Use Linux Security Modules
What Kubernetes resource configures security profiles?
Security Context in Pods or Containers.
RULE #9: Integrate Container Scanning Tools into Your CI/CD Pipeline
Why is integrating container scanning tools into a CI/CD pipeline important?
It ensures security checks, such as linting, static code analysis, and container scanning, are part of the software development lifecycle to prevent vulnerabilities.
Best Practices
What are some best practices for writing a secure Dockerfile?
Specify a USER directive.
Pin the base image version.
Pin OS package versions.
Use COPY instead of ADD.
Avoid curl bashing in RUN directives.
