mirror of
https://github.com/docker/docs.git
synced 2026-04-05 10:48:55 +07:00
2000 lines
78 KiB
HTML
2000 lines
78 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<title>Docker security </title>
|
|
<link rel="shortcut icon" href="/images/favicon.png" type="image/x-icon">
|
|
<link rel="stylesheet" href="/dist/assets/css/bootstrap-custom.css" />
|
|
<link rel="stylesheet" href="/dist/assets/css/app.css" />
|
|
<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/animate.css/3.2.6/animate.min.css">
|
|
<link rel="stylesheet" href="/css/custom.css">
|
|
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js"></script>
|
|
<script href="/dist/assets/js/modernizr.js"></script>
|
|
</head>
|
|
<body>
|
|
<div class="off-canvas-wrap" data-offcanvas>
|
|
<div class="inner-wrap">
|
|
|
|
<a class="left-off-canvas-toggle" href="#" >
|
|
<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="35px" height="35px" viewBox="0 0 35 35" enable-background="new 0 0 35 35" xml:space="preserve">
|
|
<path fill="#3597D4" d="M30.583,9.328c0,0.752-0.539,1.362-1.203,1.362H5.113c-0.664,0-1.203-0.61-1.203-1.362l0,0
|
|
c0-0.752,0.539-1.362,1.203-1.362H29.38C30.045,7.966,30.583,8.576,30.583,9.328L30.583,9.328z"/>
|
|
<path fill="#3597D4" d="M30.583,17.09c0,0.752-0.539,1.362-1.203,1.362H5.113c-0.664,0-1.203-0.61-1.203-1.362l0,0
|
|
c0-0.752,0.539-1.362,1.203-1.362H29.38C30.045,15.728,30.583,16.338,30.583,17.09L30.583,17.09z"/>
|
|
<path fill="#3597D4" d="M30.583,24.387c0,0.752-0.539,1.362-1.203,1.362H5.113c-0.664,0-1.203-0.61-1.203-1.362l0,0
|
|
c0-0.752,0.539-1.362,1.203-1.362H29.38C30.045,23.025,30.583,23.635,30.583,24.387L30.583,24.387z"/>
|
|
</svg>
|
|
</a>
|
|
<a class="button secondary small get-started-cta">Get Started</a>
|
|
<header class="main-header">
|
|
<div class="row">
|
|
<div class="large-3 columns">
|
|
<a href="/"><img class="logo" src="/dist/assets/images/logo.png"></a>
|
|
</div>
|
|
<div class="large-9 columns">
|
|
<ul class="nav-global">
|
|
<li><a href="https://www.docker.com/support">Support</a></li>
|
|
<li><a href="https://training.docker.com/">Training</a></li>
|
|
<li><a href="/">Docs</a></li>
|
|
<li><a href="http://blog.docker.com/">Blog</a></li>
|
|
<li><a href="https://hub.docker.com/account/signup/">Docker Hub</a></li>
|
|
<li><a class="button" href="/mac/started/">Get Started</a></li>
|
|
</ul>
|
|
<ul class="nav-main">
|
|
<li><a href="https://www.docker.com/products">Products</a>
|
|
<ul>
|
|
<li><a href="https://www.docker.com/pricing">Pricing</a></li>
|
|
<li><a href="https://www.docker.com/whatisdocker">What is Docker?</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a href="https://www.docker.com/customers">Customers</a></li>
|
|
<li><a href="https://www.docker.com/community">Community</a>
|
|
<ul>
|
|
<li><a href="https://www.docker.com/community/meetups">Meetups</a></li>
|
|
<li><a href="https://www.docker.com/community/events">Events</a></li>
|
|
<li><a href="https://forums.docker.com">Forums</a></li>
|
|
<li><a href="http://www.scoop.it/t/docker-by-docker">Community News</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a href="https://www.docker.com/partners">Partners</a>
|
|
<ul>
|
|
<li><a href="https://www.docker.com/partners/partner-programs">Partner Programs</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a href="https://www.docker.com/company">Company</a>
|
|
<ul>
|
|
<li><a href="https://www.docker.com/news-and-press">News & Press</a></li>
|
|
<li><a href="https://www.docker.com/work-docker">Work at Docker</a></li>
|
|
<li><a href="https://www.docker.com/company/management">Management</a></li>
|
|
<li><a href="https://www.docker.com/company/contact">Contact</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a href="https://www.docker.com/open-source">Open Source</a>
|
|
<ul>
|
|
<li><a href="https://www.docker.com/contribute">Contribute</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
</header>
|
|
|
|
|
|
<aside class="left-off-canvas-menu">
|
|
<ul class="off-canvas-list">
|
|
<li class="has-submenu"><a href="#">Products</a>
|
|
<ul class="left-submenu">
|
|
<li class="back"><a href="#">Back</a></li>
|
|
<li><a href="#">Pricing</a></li>
|
|
<li><a href="#">What Is Docker</a></li>
|
|
<li><a href="#">Products</a></li>
|
|
<li><a href="#">Docker Engine</a></li>
|
|
<li><a href="#">Docker Hub</a></li>
|
|
<li><a href="#">Docker Registry</a></li>
|
|
<li><a href="#">Docker Machine</a></li>
|
|
<li><a href="#">Docker Swarm</a></li>
|
|
<li><a href="#">Docker Compose</a></li>
|
|
<li><a href="#">Kitematic</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a href="#">Customers</a></li>
|
|
<li class="has-submenu"><a href="#">Community</a>
|
|
<ul class="left-submenu">
|
|
<li class="back"><a href="#">Back</a></li>
|
|
<li><a href="#">Community</a></li>
|
|
<li><a href="#">Meetups</a></li>
|
|
<li><a href="https://www.docker.com/community/events">Events</a></li>
|
|
<li><a href="#">Forum</a></li>
|
|
<li><a href="#">Scoop.it</a></li>
|
|
</ul>
|
|
</li>
|
|
<li class="has-submenu"><a href="#">Partners</a>
|
|
<ul class="left-submenu">
|
|
<li class="back"><a href="#">Back</a></li>
|
|
<li><a href="#">Partners</a></li>
|
|
<li><a href="https://www.docker.com/partners/partner-programs">Partners Programs</a></li>
|
|
</ul>
|
|
</li>
|
|
<li><a href="#">Company</a></li>
|
|
<li class="has-submenu"><a href="#">Open Source</a>
|
|
<ul class="left-submenu">
|
|
<li class="back"><a href="#">Back</a></li>
|
|
<li><a href="#">Open Source</a></li>
|
|
<li><a href="#">Contribute</a></li>
|
|
<li><a href="#">Governance</a></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
<ul class="nav-global-off-canvas">
|
|
<li><a href="#">Support</a></li>
|
|
<li><a href="#">Training</a></li>
|
|
<li><a href="#">Docs</a></li>
|
|
<li><a href="#">Blog</a></li>
|
|
<li><a href="#">Sign in</a></li>
|
|
<li><a href="#">Sign up</a></li>
|
|
</ul>
|
|
</aside>
|
|
|
|
<a class="exit-off-canvas"></a>
|
|
<div id="docs" class="row">
|
|
<div class="large-3 columns">
|
|
<section id="multiple" data-accordion-group>
|
|
|
|
|
|
<section data-accordion>
|
|
|
|
<article data-accordion>
|
|
<button data-control> Install</button>
|
|
<div data-content>
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker Engine</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/installation/mac/" class=""> Installation on Mac OS X</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/installation/windows/" class=""> Installation on Windows</a>
|
|
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Linux</button>
|
|
<div data-content>
|
|
|
|
<a data-link href="/docker/installation/archlinux/" class=""> Installation on Arch Linux</a>
|
|
|
|
<a data-link href="/docker/installation/cruxlinux/" class=""> Installation on CRUX Linux</a>
|
|
|
|
<a data-link href="/docker/installation/centos/" class=""> Installation on CentOS</a>
|
|
|
|
<a data-link href="/docker/installation/debian/" class=""> Installation on Debian</a>
|
|
|
|
<a data-link href="/docker/installation/fedora/" class=""> Installation on Fedora</a>
|
|
|
|
<a data-link href="/docker/installation/frugalware/" class=""> Installation on FrugalWare</a>
|
|
|
|
<a data-link href="/docker/installation/gentoolinux/" class=""> Installation on Gentoo</a>
|
|
|
|
<a data-link href="/docker/installation/oracle/" class=""> Installation on Oracle Linux</a>
|
|
|
|
<a data-link href="/docker/installation/rhel/" class=""> Installation on Red Hat Enterprise Linux</a>
|
|
|
|
<a data-link href="/docker/installation/ubuntulinux/" class=""> Installation on Ubuntu </a>
|
|
|
|
<a data-link href="/docker/installation/SUSE/" class=""> Installation on openSUSE and SUSE Linux Enterprise</a>
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Cloud</button>
|
|
<div data-content>
|
|
|
|
<a data-link href="/docker/installation/amazon/" class=""> Amazon EC2 Installation</a>
|
|
|
|
<a data-link href="/docker/installation/joyent/" class=""> Install on Joyent Public Cloud</a>
|
|
|
|
<a data-link href="/docker/installation/google/" class=""> Installation on Google Cloud Platform</a>
|
|
|
|
<a data-link href="/docker/installation/softlayer/" class=""> Installation on IBM SoftLayer </a>
|
|
|
|
<a data-link href="/docker/installation/azure/" class=""> Installation on Microsoft Azure platform</a>
|
|
|
|
<a data-link href="/docker/installation/rackspace/" class=""> Installation on Rackspace Cloud</a>
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/installation/binaries/" class=""> Installation from binaries</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<a data-link href="/kitematic/" class=""> Kitematic</a>
|
|
|
|
|
|
|
|
<a data-link href="/machine/install-machine/" class=""> Docker Machine</a>
|
|
|
|
|
|
|
|
<a data-link href="/compose/install/" class=""> Docker Compose</a>
|
|
|
|
|
|
|
|
<a data-link href="/swarm/install-w-machine/" class=""> Docker Swarm</a>
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
</section>
|
|
|
|
<section data-accordion>
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker Fundamentals</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/userguide/" class=""> The Docker user guide</a>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Work with Docker Images</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/articles/dockerfile_best-practices/" class=""> Best practices for writing Dockerfiles</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/articles/baseimages/" class=""> Create a base image</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/userguide/dockerimages/" class=""> Get started with images</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/userguide/dockerrepos/" class=""> Get started with Docker Hub</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Work with Docker Containers</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/articles/basics/" class=""> Get started with containers</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/userguide/usingdocker/" class=""> Working with containers</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/userguide/dockervolumes/" class=""> Managing data in containers</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/userguide/dockerlinks/" class=""> Linking containers together</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/articles/host_integration/" class=""> Automatically start containers</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker on Windows & OSX</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/articles/dsc/" class=""> PowerShell DSC Usage</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/articles/b2d_volume_resize/" class=""> Resizing a Boot2Docker volume </a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Use the Kitematic GUI</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/kitematic/userguide/" class=""> Kitematic User Guide: Intro & Overview</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/kitematic/nginx-web-server/" class=""> Set up an Nginx web server</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/kitematic/minecraft-server/" class=""> Set up a Minecraft Server</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/kitematic/rethinkdb-dev-database/" class=""> Creating a Local RethinkDB Database for Development</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/kitematic/faq/" class=""> Frequently Asked Questions</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/kitematic/known-issues/" class=""> Known Issues</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
</section>
|
|
|
|
<section data-accordion>
|
|
|
|
<article data-accordion>
|
|
<button data-control> Use Docker</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/misc/" class=""> About Docker</a>
|
|
|
|
|
|
|
|
<a data-link href="/docker/userguide/labels-custom-metadata/" class=""> Apply custom metadata</a>
|
|
|
|
|
|
|
|
<a data-link href="/docker/introduction/understanding-docker/" class=""> Understand the architecture</a>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Provision & set up Docker hosts</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/machine/" class=""> Overview of Docker Machine</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Create multi-container applications</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/compose/" class=""> Overview of Docker Compose</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/compose/production/" class=""> Using Compose in production</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/compose/extends/" class=""> Extending services in Compose</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/compose/completion/" class=""> Command Completion</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/compose/django/" class=""> Quickstart Guide: Compose and Django</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/compose/rails/" class=""> Quickstart Guide: Compose and Rails</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/compose/wordpress/" class=""> Quickstart Guide: Compose and Wordpress</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Cluster Docker containers</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/swarm/" class=""> Docker Swarm</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/swarm/install-manual/" class=""> Create a swarm for development</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/swarm/discovery/" class=""> Docker Swarm discovery</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/swarm/scheduler/filter/" class=""> Docker Swarm filters</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/swarm/scheduler/strategy/" class=""> Docker Swarm strategies</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Adminstrate Docker</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/articles/networking/" class=""> Network configuration</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/articles/security/" class=""> Docker security</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/articles/configuring/" class=""> Configuring and running Docker</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/articles/runmetrics/" class=""> Runtime metrics</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/articles/https/" class=""> Protect the Docker daemon socket</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/articles/ambassador_pattern_linking/" class=""> Link via an ambassador container</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/articles/systemd/" class=""> Control and configure Docker with systemd</a>
|
|
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Applications and Services</button>
|
|
<div data-content>
|
|
|
|
<a data-link href="/docker/examples/running_riak_service/" class=""> Dockerizing a Riak service</a>
|
|
|
|
<a data-link href="/docker/examples/running_ssh_service/" class=""> Dockerizing an SSH service</a>
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Integrate with Third-party Tools</button>
|
|
<div data-content>
|
|
|
|
<a data-link href="/articles/cfengine_process_management/" class=""> Process management with CFEngine</a>
|
|
|
|
<a data-link href="/articles/chef/" class=""> Using Chef</a>
|
|
|
|
<a data-link href="/articles/puppet/" class=""> Using Puppet</a>
|
|
|
|
<a data-link href="/articles/using_supervisord/" class=""> Using Supervisor with Docker</a>
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Applied Docker</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/examples/mongodb/" class=""> Dockerizing MongoDB</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/examples/postgresql_service/" class=""> Dockerizing PostgreSQL</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/examples/couchdb_data_volumes/" class=""> Dockerizing a CouchDB service</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/examples/nodejs_web_app/" class=""> Dockerizing a Node.js web app</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/examples/running_redis_service/" class=""> Dockerizing a Redis service</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/examples/apt-cacher-ng/" class=""> Dockerizing an apt-cacher-ng service</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/userguide/dockerizing/" class=""> Dockerizing applications: A 'Hello world'</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
</section>
|
|
|
|
<section data-accordion>
|
|
|
|
<article data-accordion>
|
|
<button data-control> Manage image repositories</button>
|
|
<div data-content>
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> The Public Hub</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/docker-hub/userguide/" class=""> Docker Hub user guide</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/docker-hub/" class=""> The Docker Hub</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/docker-hub/accounts/" class=""> Accounts on Docker Hub</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/userguide/dockerhub/" class=""> Getting started with Docker Hub</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/docker-hub/repos/" class=""> Your Repositories on Docker Hub</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/docker-hub/builds/" class=""> Automated Builds on Docker Hub</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/docker-hub/official_repos/" class=""> Official Repositories on Docker Hub</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker Trusted Registry</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker-trusted-registry/" class=""> Overview</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker-trusted-registry/quick-start/" class=""> Quick-start: Basic Workflow</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker-trusted-registry/userguide/" class=""> User guide</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker-trusted-registry/adminguide/" class=""> Admin guide</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker-trusted-registry/install/" class=""> Installation</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker-trusted-registry/configuration/" class=""> Configuration options</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker-trusted-registry/support/" class=""> Support</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker-trusted-registry/release-notes/" class=""> Release notes</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker-trusted-registry/prior-release-notes/" class=""> Prior release notes archive</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker Registry</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/registry/" class=""> Docker Registry 2.0</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/registry/introduction/" class=""> Understanding the Registry</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/registry/deploying/" class=""> Deploying a registry server</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/registry/configuration/" class=""> Configure a Registry</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/registry/notifications/" class=""> Work with Notifications</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/registry/authentication/" class=""> Authentication for the Registry</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/registry/help/" class=""> Getting help</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<a data-link href="/articles/certificates/" class=""> Using certificates for repository client verification</a>
|
|
|
|
|
|
|
|
<a data-link href="/articles/registry_mirror/" class=""> Run a local registry mirror</a>
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
</section>
|
|
|
|
<section data-accordion>
|
|
|
|
<article data-accordion>
|
|
<button data-control> Command and API references</button>
|
|
<div data-content>
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Command line reference</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/cli/" class=""> Using the command line</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/daemon/" class=""> daemon</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/attach/" class=""> attach</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/build/" class=""> build</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/commit/" class=""> commit</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/cp/" class=""> cp</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/create/" class=""> create</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/diff/" class=""> diff</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/events/" class=""> events</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/exec/" class=""> exec</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/export/" class=""> export</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/history/" class=""> history</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/images/" class=""> images</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/import/" class=""> import</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/info/" class=""> info</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/inspect/" class=""> inspect</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/kill/" class=""> kill</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/load/" class=""> load</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/login/" class=""> login</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/logout/" class=""> logout</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/logs/" class=""> logs</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/pause/" class=""> pause</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/port/" class=""> port</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/ps/" class=""> ps</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/pull/" class=""> pull</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/push/" class=""> push</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/rename/" class=""> rename</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/restart/" class=""> restart</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/rm/" class=""> rm</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/rmi/" class=""> rmi</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/run/" class=""> run</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/save/" class=""> save</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/search/" class=""> search</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/start/" class=""> start</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/stats/" class=""> stats</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/stop/" class=""> stop</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/tag/" class=""> tag</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/top/" class=""> top</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/unpause/" class=""> unpause</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/version/" class=""> version</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/commandline/wait/" class=""> wait</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/run/" class=""> Docker run reference</a>
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/builder/" class=""> Dockerfile reference</a>
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/api/remote_api_client_libraries/" class=""> Remote API client libraries</a>
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/api/docker_io_accounts_api/" class=""> docker.io accounts API</a>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker Remote API</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/reference/api/docker-io_api/" class=""> Docker Hub API</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/api/docker_remote_api/" class=""> Remote API</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/api/docker_remote_api_v1.19/" class=""> Remote API v1.19</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/api/docker_remote_api_v1.18/" class=""> Remote API v1.18</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/api/docker_remote_api_v1.17/" class=""> Remote API v1.17</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/api/docker_remote_api_v1.16/" class=""> Remote API v1.16</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/api/docker_remote_api_v1.15/" class=""> Remote API v1.15</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/api/docker_remote_api_v1.14/" class=""> Remote API v1.14</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker Hub</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/reference/api/hub_registry_spec/" class=""> The Docker Hub and the Registry v1</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker Compose Reference</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/compose/cli/" class=""> Compose CLI reference</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/compose/yml/" class=""> docker-compose.yml reference</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/compose/env/" class=""> Compose environment variables reference</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<a data-link href="" class=""> Docker Machine Reference</a>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker Swarm Reference</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/swarm/api/swarm-api/" class=""> Docker Swarm API</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Docker Registry Reference</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/registry/spec/api/" class=""> Docker Registry HTTP API V2</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/registry/storagedrivers/" class=""> Docker Registry Storage Driver</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/registry/spec/auth/token/" class=""> Docker Registry v2 Authentication</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
</section>
|
|
|
|
<section data-accordion>
|
|
|
|
<article data-accordion>
|
|
<button data-control> Open Source at Docker</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/opensource/how-to-contribute/" class=""> Overview of contributing</a>
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/get-help/" class=""> Where to chat or get help</a>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Configure Development Environment</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/project/who-written-for/" class=""> README first</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/software-required/" class=""> Get the required software</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/software-req-win/" class=""> Set up for development on Windows</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/set-up-git/" class=""> Configure Git for contributing</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/set-up-dev-env/" class=""> Work with a development container</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/test-and-docs/" class=""> Run tests and test documentation</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Contribution Workflow</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/docker/project/make-a-contribution/" class=""> Understand how to contribute</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/find-an-issue/" class=""> Find and claim an issue</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/work-issue/" class=""> Work on your issue</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/create-pr/" class=""> Create a pull request (PR)</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/review-pr/" class=""> Participate in the PR review</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/advanced-contributing/" class=""> Advanced contributing</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/coding-style/" class=""> Coding style checklist</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<a data-link href="/opensource/code/" class=""> Contribute code overview</a>
|
|
|
|
|
|
|
|
<a data-link href="/opensource/community/" class=""> Support the community</a>
|
|
|
|
|
|
|
|
<a data-link href="/opensource/issues/" class=""> Organize our issues</a>
|
|
|
|
|
|
|
|
<a data-link href="/opensource/meetups/" class=""> Organize a Docker Meetup</a>
|
|
|
|
|
|
|
|
<a data-link href="/opensource/test/" class=""> Testing contributions</a>
|
|
|
|
|
|
|
|
<article data-accordion>
|
|
<button data-control> Governance</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/opensource/governance/dgab-info/" class=""> Docker Governance Advisory Board</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/opensource/governance/board-profiles/" class=""> Board member profiles</a>
|
|
|
|
|
|
|
|
|
|
<a data-link href="/opensource/governance/conduct-code/" class=""> Code of conduct</a>
|
|
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
|
|
|
|
<a data-link href="/docker/project/doc-style/" class=""> Style guide for Docker documentation</a>
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
</section>
|
|
|
|
<section data-accordion>
|
|
|
|
<article data-accordion>
|
|
<button data-control> About</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="/release-notes/" class=""> Docker Release Notes</a>
|
|
|
|
|
|
|
|
<a data-link href="/swarm/release-notes/" class=""> Docker Swarm Release Notes</a>
|
|
|
|
|
|
|
|
<a data-link href="/docker/misc/faq/" class=""> FAQ</a>
|
|
|
|
|
|
|
|
<a data-link href="/docker/reference/glossary/" class=""> Docker Glossary</a>
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
</section>
|
|
|
|
<section data-accordion>
|
|
|
|
<article data-accordion>
|
|
<button style="visibility: hidden" data-control> Get older docs</button>
|
|
<div data-content>
|
|
|
|
|
|
<a data-link href="https://docs.docker.com/v1.6/" class=""> Version 1.6</a>
|
|
|
|
|
|
|
|
<a data-link href="https://docs.docker.com/v1.5/" class=""> Version 1.5</a>
|
|
|
|
|
|
|
|
<a data-link href="https://docs.docker.com/v1.4/" class=""> Version 1.4</a>
|
|
|
|
|
|
</div>
|
|
</article>
|
|
|
|
</section>
|
|
|
|
</section>
|
|
|
|
<script>
|
|
$(document).ready(function () {
|
|
var $activeLink = $('#multiple [data-link].active');
|
|
var $accordions = $activeLink.parents('article[data-accordion]');
|
|
$($accordions.get().reverse()).each(function (index, accordion) {
|
|
var $accordion = $(accordion);
|
|
var $content = $accordion.find('[data-content]');
|
|
$accordion.addClass('open');
|
|
$content.css({'max-height': '100%'});
|
|
});
|
|
});
|
|
</script>
|
|
</div>
|
|
<div class="large-6 columns">
|
|
<section id="main">
|
|
<article id="content">
|
|
|
|
|
|
<h1 id="docker-security">Docker security</h1>
|
|
|
|
<p>There are three major areas to consider when reviewing Docker security:</p>
|
|
|
|
<ul>
|
|
<li>the intrinsic security of the kernel and its support for
|
|
namespaces and cgroups;</li>
|
|
<li>the attack surface of the Docker daemon itself;</li>
|
|
<li>loopholes in the container configuration profile, either by default,
|
|
or when customized by users.</li>
|
|
<li>the “hardening” security features of the kernel and how they
|
|
interact with containers.</li>
|
|
</ul>
|
|
|
|
<h2 id="kernel-namespaces">Kernel namespaces</h2>
|
|
|
|
<p>Docker containers are very similar to LXC containers, and they have
|
|
similar security features. When you start a container with
|
|
<code>docker run</code>, behind the scenes Docker creates a set of namespaces and control
|
|
groups for the container.</p>
|
|
|
|
<p><strong>Namespaces provide the first and most straightforward form of
|
|
isolation</strong>: processes running within a container cannot see, and even
|
|
less affect, processes running in another container, or in the host
|
|
system.</p>
|
|
|
|
<p><strong>Each container also gets its own network stack</strong>, meaning that a
|
|
container doesn’t get privileged access to the sockets or interfaces
|
|
of another container. Of course, if the host system is setup
|
|
accordingly, containers can interact with each other through their
|
|
respective network interfaces — just like they can interact with
|
|
external hosts. When you specify public ports for your containers or use
|
|
<a href="/userguide/dockerlinks"><em>links</em></a>
|
|
then IP traffic is allowed between containers. They can ping each other,
|
|
send/receive UDP packets, and establish TCP connections, but that can be
|
|
restricted if necessary. From a network architecture point of view, all
|
|
containers on a given Docker host are sitting on bridge interfaces. This
|
|
means that they are just like physical machines connected through a
|
|
common Ethernet switch; no more, no less.</p>
|
|
|
|
<p>How mature is the code providing kernel namespaces and private
|
|
networking? Kernel namespaces were introduced <a href="http://lxc.sourceforge.net/index.php/about/kernel-namespaces/">between kernel version
|
|
2.6.15 and
|
|
2.6.26</a>.
|
|
This means that since July 2008 (date of the 2.6.26 release, now 5 years
|
|
ago), namespace code has been exercised and scrutinized on a large
|
|
number of production systems. And there is more: the design and
|
|
inspiration for the namespaces code are even older. Namespaces are
|
|
actually an effort to reimplement the features of <a href="http://en.wikipedia.org/wiki/OpenVZ">OpenVZ</a> in such a way that they could be
|
|
merged within the mainstream kernel. And OpenVZ was initially released
|
|
in 2005, so both the design and the implementation are pretty mature.</p>
|
|
|
|
<h2 id="control-groups">Control groups</h2>
|
|
|
|
<p>Control Groups are another key component of Linux Containers. They
|
|
implement resource accounting and limiting. They provide many
|
|
useful metrics, but they also help ensure that each container gets
|
|
its fair share of memory, CPU, disk I/O; and, more importantly, that a
|
|
single container cannot bring the system down by exhausting one of those
|
|
resources.</p>
|
|
|
|
<p>So while they do not play a role in preventing one container from
|
|
accessing or affecting the data and processes of another container, they
|
|
are essential to fend off some denial-of-service attacks. They are
|
|
particularly important on multi-tenant platforms, like public and
|
|
private PaaS, to guarantee a consistent uptime (and performance) even
|
|
when some applications start to misbehave.</p>
|
|
|
|
<p>Control Groups have been around for a while as well: the code was
|
|
started in 2006, and initially merged in kernel 2.6.24.</p>
|
|
|
|
<h2 id="docker-daemon-attack-surface">Docker daemon attack surface</h2>
|
|
|
|
<p>Running containers (and applications) with Docker implies running the
|
|
Docker daemon. This daemon currently requires <code>root</code> privileges, and you
|
|
should therefore be aware of some important details.</p>
|
|
|
|
<p>First of all, <strong>only trusted users should be allowed to control your
|
|
Docker daemon</strong>. This is a direct consequence of some powerful Docker
|
|
features. Specifically, Docker allows you to share a directory between
|
|
the Docker host and a guest container; and it allows you to do so
|
|
without limiting the access rights of the container. This means that you
|
|
can start a container where the <code>/host</code> directory will be the <code>/</code> directory
|
|
on your host; and the container will be able to alter your host filesystem
|
|
without any restriction. This is similar to how virtualization systems
|
|
allow filesystem resource sharing. Nothing prevents you from sharing your
|
|
root filesystem (or even your root block device) with a virtual machine.</p>
|
|
|
|
<p>This has a strong security implication: for example, if you instrument Docker
|
|
from a web server to provision containers through an API, you should be
|
|
even more careful than usual with parameter checking, to make sure that
|
|
a malicious user cannot pass crafted parameters causing Docker to create
|
|
arbitrary containers.</p>
|
|
|
|
<p>For this reason, the REST API endpoint (used by the Docker CLI to
|
|
communicate with the Docker daemon) changed in Docker 0.5.2, and now
|
|
uses a UNIX socket instead of a TCP socket bound on 127.0.0.1 (the
|
|
latter being prone to cross-site-scripting attacks if you happen to run
|
|
Docker directly on your local machine, outside of a VM). You can then
|
|
use traditional UNIX permission checks to limit access to the control
|
|
socket.</p>
|
|
|
|
<p>You can also expose the REST API over HTTP if you explicitly decide to do so.
|
|
However, if you do that, being aware of the above mentioned security
|
|
implication, you should ensure that it will be reachable only from a
|
|
trusted network or VPN; or protected with e.g., <code>stunnel</code> and client SSL
|
|
certificates. You can also secure them with <a href="/articles/https/">HTTPS and
|
|
certificates</a>.</p>
|
|
|
|
<p>The daemon is also potentially vulnerable to other inputs, such as image
|
|
loading from either disk with ‘docker load’, or from the network with
|
|
‘docker pull’. This has been a focus of improvement in the community,
|
|
especially for ‘pull’ security. While these overlap, it should be noted
|
|
that ‘docker load’ is a mechanism for backup and restore and is not
|
|
currently considered a secure mechanism for loading images. As of
|
|
Docker 1.3.2, images are now extracted in a chrooted subprocess on
|
|
Linux/Unix platforms, being the first-step in a wider effort toward
|
|
privilege separation.</p>
|
|
|
|
<p>Eventually, it is expected that the Docker daemon will run restricted
|
|
privileges, delegating operations well-audited sub-processes,
|
|
each with its own (very limited) scope of Linux capabilities,
|
|
virtual network setup, filesystem management, etc. That is, most likely,
|
|
pieces of the Docker engine itself will run inside of containers.</p>
|
|
|
|
<p>Finally, if you run Docker on a server, it is recommended to run
|
|
exclusively Docker in the server, and move all other services within
|
|
containers controlled by Docker. Of course, it is fine to keep your
|
|
favorite admin tools (probably at least an SSH server), as well as
|
|
existing monitoring/supervision processes (e.g., NRPE, collectd, etc).</p>
|
|
|
|
<h2 id="linux-kernel-capabilities">Linux kernel capabilities</h2>
|
|
|
|
<p>By default, Docker starts containers with a restricted set of
|
|
capabilities. What does that mean?</p>
|
|
|
|
<p>Capabilities turn the binary “root/non-root” dichotomy into a
|
|
fine-grained access control system. Processes (like web servers) that
|
|
just need to bind on a port below 1024 do not have to run as root: they
|
|
can just be granted the <code>net_bind_service</code> capability instead. And there
|
|
are many other capabilities, for almost all the specific areas where root
|
|
privileges are usually needed.</p>
|
|
|
|
<p>This means a lot for container security; let’s see why!</p>
|
|
|
|
<p>Your average server (bare metal or virtual machine) needs to run a bunch
|
|
of processes as root. Those typically include SSH, cron, syslogd;
|
|
hardware management tools (e.g., load modules), network configuration
|
|
tools (e.g., to handle DHCP, WPA, or VPNs), and much more. A container is
|
|
very different, because almost all of those tasks are handled by the
|
|
infrastructure around the container:</p>
|
|
|
|
<ul>
|
|
<li>SSH access will typically be managed by a single server running on
|
|
the Docker host;</li>
|
|
<li><code>cron</code>, when necessary, should run as a user
|
|
process, dedicated and tailored for the app that needs its
|
|
scheduling service, rather than as a platform-wide facility;</li>
|
|
<li>log management will also typically be handed to Docker, or by
|
|
third-party services like Loggly or Splunk;</li>
|
|
<li>hardware management is irrelevant, meaning that you never need to
|
|
run <code>udevd</code> or equivalent daemons within
|
|
containers;</li>
|
|
<li>network management happens outside of the containers, enforcing
|
|
separation of concerns as much as possible, meaning that a container
|
|
should never need to perform <code>ifconfig</code>,
|
|
<code>route</code>, or ip commands (except when a container
|
|
is specifically engineered to behave like a router or firewall, of
|
|
course).</li>
|
|
</ul>
|
|
|
|
<p>This means that in most cases, containers will not need “real” root
|
|
privileges <em>at all</em>. And therefore, containers can run with a reduced
|
|
capability set; meaning that “root” within a container has much less
|
|
privileges than the real “root”. For instance, it is possible to:</p>
|
|
|
|
<ul>
|
|
<li>deny all “mount” operations;</li>
|
|
<li>deny access to raw sockets (to prevent packet spoofing);</li>
|
|
<li>deny access to some filesystem operations, like creating new device
|
|
nodes, changing the owner of files, or altering attributes (including
|
|
the immutable flag);</li>
|
|
<li>deny module loading;</li>
|
|
<li>and many others.</li>
|
|
</ul>
|
|
|
|
<p>This means that even if an intruder manages to escalate to root within a
|
|
container, it will be much harder to do serious damage, or to escalate
|
|
to the host.</p>
|
|
|
|
<p>This won’t affect regular web apps; but malicious users will find that
|
|
the arsenal at their disposal has shrunk considerably! By default Docker
|
|
drops all capabilities except <a href="https://github.com/docker/docker/blob/master/daemon/execdriver/native/template/default_template.go">those
|
|
needed</a>,
|
|
a whitelist instead of a blacklist approach. You can see a full list of
|
|
available capabilities in <a href="http://man7.org/linux/man-pages/man7/capabilities.7.html">Linux
|
|
manpages</a>.</p>
|
|
|
|
<p>One primary risk with running Docker containers is that the default set
|
|
of capabilities and mounts given to a container may provide incomplete
|
|
isolation, either independently, or when used in combination with
|
|
kernel vulnerabilities.</p>
|
|
|
|
<p>Docker supports the addition and removal of capabilities, allowing use
|
|
of a non-default profile. This may make Docker more secure through
|
|
capability removal, or less secure through the addition of capabilities.
|
|
The best practice for users would be to remove all capabilities except
|
|
those explicitly required for their processes.</p>
|
|
|
|
<h2 id="other-kernel-security-features">Other kernel security features</h2>
|
|
|
|
<p>Capabilities are just one of the many security features provided by
|
|
modern Linux kernels. It is also possible to leverage existing,
|
|
well-known systems like TOMOYO, AppArmor, SELinux, GRSEC, etc. with
|
|
Docker.</p>
|
|
|
|
<p>While Docker currently only enables capabilities, it doesn’t interfere
|
|
with the other systems. This means that there are many different ways to
|
|
harden a Docker host. Here are a few examples.</p>
|
|
|
|
<ul>
|
|
<li>You can run a kernel with GRSEC and PAX. This will add many safety
|
|
checks, both at compile-time and run-time; it will also defeat many
|
|
exploits, thanks to techniques like address randomization. It doesn’t
|
|
require Docker-specific configuration, since those security features
|
|
apply system-wide, independent of containers.</li>
|
|
<li>If your distribution comes with security model templates for
|
|
Docker containers, you can use them out of the box. For instance, we
|
|
ship a template that works with AppArmor and Red Hat comes with SELinux
|
|
policies for Docker. These templates provide an extra safety net (even
|
|
though it overlaps greatly with capabilities).</li>
|
|
<li>You can define your own policies using your favorite access control
|
|
mechanism.</li>
|
|
</ul>
|
|
|
|
<p>Just like there are many third-party tools to augment Docker containers
|
|
with e.g., special network topologies or shared filesystems, you can
|
|
expect to see tools to harden existing Docker containers without
|
|
affecting Docker’s core.</p>
|
|
|
|
<p>Recent improvements in Linux namespaces will soon allow to run
|
|
full-featured containers without root privileges, thanks to the new user
|
|
namespace. This is covered in detail <a href="http://s3hh.wordpress.com/2013/07/19/creating-and-using-containers-without-privilege/">here</a>.
|
|
Moreover, this will solve the problem caused by sharing filesystems
|
|
between host and guest, since the user namespace allows users within
|
|
containers (including the root user) to be mapped to other users in the
|
|
host system.</p>
|
|
|
|
<p>Today, Docker does not directly support user namespaces, but they
|
|
may still be utilized by Docker containers on supported kernels,
|
|
by directly using the clone syscall, or utilizing the ‘unshare’
|
|
utility. Using this, some users may find it possible to drop
|
|
more capabilities from their process as user namespaces provide
|
|
an artificial capabilities set. Likewise, however, this artificial
|
|
capabilities set may require use of ‘capsh’ to restrict the
|
|
user-namespace capabilities set when using ‘unshare’.</p>
|
|
|
|
<p>Eventually, it is expected that Docker will have direct, native support
|
|
for user-namespaces, simplifying the process of hardening containers.</p>
|
|
|
|
<h2 id="conclusions">Conclusions</h2>
|
|
|
|
<p>Docker containers are, by default, quite secure; especially if you take
|
|
care of running your processes inside the containers as non-privileged
|
|
users (i.e., non-<code>root</code>).</p>
|
|
|
|
<p>You can add an extra layer of safety by enabling Apparmor, SELinux,
|
|
GRSEC, or your favorite hardening solution.</p>
|
|
|
|
<p>Last but not least, if you see interesting security features in other
|
|
containerization systems, these are simply kernels features that may
|
|
be implemented in Docker as well. We welcome users to submit issues,
|
|
pull requests, and communicate via the mailing list.</p>
|
|
|
|
<p>References:
|
|
* <a href="http://blog.docker.com/2013/08/containers-docker-how-secure-are-they/">Docker Containers: How Secure Are They? (2013)</a>.
|
|
* <a href="https://medium.com/@ewindisch/on-the-security-of-containers-2c60ffe25a9e">On the Security of Containers (2014)</a>.</p>
|
|
|
|
</article>
|
|
</section>
|
|
</div>
|
|
<div id="toc" class="large-3 columns toc ">
|
|
On this page:
|
|
<nav id="TableOfContents">
|
|
<ul>
|
|
<li><a href="#docker-security">Docker security</a>
|
|
<ul>
|
|
<li><a href="#kernel-namespaces">Kernel namespaces</a></li>
|
|
<li><a href="#control-groups">Control groups</a></li>
|
|
<li><a href="#docker-daemon-attack-surface">Docker daemon attack surface</a></li>
|
|
<li><a href="#linux-kernel-capabilities">Linux kernel capabilities</a></li>
|
|
<li><a href="#other-kernel-security-features">Other kernel security features</a></li>
|
|
<li><a href="#conclusions">Conclusions</a></li>
|
|
</ul></li>
|
|
</ul>
|
|
</nav>
|
|
</div>
|
|
</div>
|
|
|
|
<footer class="main-footer">
|
|
<div class="row">
|
|
</div>
|
|
<div class="row">
|
|
</div>
|
|
<div id="buildinfo">
|
|
Jul 8, 2015 at 6:45pm (PST)
|
|
BUILD_DATA
|
|
</div>
|
|
</footer>
|
|
<link rel="stylesheet" href="/highlight/styles/github.css">
|
|
<script src="/highlight/highlight.pack.js"></script>
|
|
<script>hljs.initHighlightingOnLoad();</script>
|
|
|
|
<script src="/dist/assets/js/all.js"></script>
|
|
<script>
|
|
$( 'nav li:has(ul)' ).doubleTapToGo();
|
|
</script>
|
|
<script>
|
|
|
|
;(function ( $, window, document, undefined ) {
|
|
|
|
var pluginName = 'accordion',
|
|
defaults = {
|
|
transitionSpeed: 300,
|
|
transitionEasing: 'ease',
|
|
controlElement: '[data-control]',
|
|
contentElement: '[data-content]',
|
|
groupElement: '[data-accordion-group]',
|
|
singleOpen: true
|
|
};
|
|
|
|
function Accordion(element, options) {
|
|
this.element = element;
|
|
this.options = $.extend({}, defaults, options);
|
|
this._defaults = defaults;
|
|
this._name = pluginName;
|
|
this.init();
|
|
}
|
|
|
|
Accordion.prototype.init = function () {
|
|
var self = this,
|
|
opts = self.options;
|
|
|
|
var $accordion = $(self.element),
|
|
$controls = $accordion.find('> ' + opts.controlElement),
|
|
$content = $accordion.find('> ' + opts.contentElement);
|
|
|
|
var accordionParentsQty = $accordion.parents('[data-accordion]').length,
|
|
accordionHasParent = accordionParentsQty > 0;
|
|
|
|
var closedCSS = { 'max-height': 0, 'overflow': 'hidden' };
|
|
|
|
var CSStransitions = supportsTransitions();
|
|
|
|
function debounce(func, threshold, execAsap) {
|
|
var timeout;
|
|
|
|
return function debounced() {
|
|
var obj = this,
|
|
args = arguments;
|
|
|
|
function delayed() {
|
|
if (!execAsap) func.apply(obj, args);
|
|
timeout = null;
|
|
};
|
|
|
|
if (timeout) clearTimeout(timeout);
|
|
else if (execAsap) func.apply(obj, args);
|
|
|
|
timeout = setTimeout(delayed, threshold || 100);
|
|
};
|
|
}
|
|
|
|
function supportsTransitions() {
|
|
var b = document.body || document.documentElement,
|
|
s = b.style,
|
|
p = 'transition';
|
|
|
|
if (typeof s[p] == 'string') {
|
|
return true;
|
|
}
|
|
|
|
var v = ['Moz', 'webkit', 'Webkit', 'Khtml', 'O', 'ms'];
|
|
|
|
p = 'Transition';
|
|
|
|
for (var i=0; i<v.length; i++) {
|
|
if (typeof s[v[i] + p] == 'string') {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
function requestAnimFrame(cb) {
|
|
if(window.requestAnimationFrame || window.webkitRequestAnimationFrame || window.mozRequestAnimationFrame) {
|
|
return requestAnimationFrame(cb) ||
|
|
webkitRequestAnimationFrame(cb) ||
|
|
mozRequestAnimationFrame(cb);
|
|
} else {
|
|
return setTimeout(cb, 1000 / 60);
|
|
}
|
|
}
|
|
|
|
function toggleTransition($el, remove) {
|
|
if(!remove) {
|
|
$content.css({
|
|
'-webkit-transition': 'max-height ' + opts.transitionSpeed + 'ms ' + opts.transitionEasing,
|
|
'transition': 'max-height ' + opts.transitionSpeed + 'ms ' + opts.transitionEasing
|
|
});
|
|
} else {
|
|
$content.css({
|
|
'-webkit-transition': '',
|
|
'transition': ''
|
|
});
|
|
}
|
|
}
|
|
|
|
function calculateHeight($el) {
|
|
var height = 0;
|
|
|
|
$el.children().each(function() {
|
|
height = height + $(this).outerHeight(true);
|
|
});
|
|
|
|
$el.data('oHeight', height);
|
|
}
|
|
|
|
function updateParentHeight($parentAccordion, $currentAccordion, qty, operation) {
|
|
var $content = $parentAccordion.filter('.open').find('> [data-content]'),
|
|
$childs = $content.find('[data-accordion].open > [data-content]'),
|
|
$matched;
|
|
|
|
if(!opts.singleOpen) {
|
|
$childs = $childs.not($currentAccordion.siblings('[data-accordion].open').find('> [data-content]'));
|
|
}
|
|
|
|
$matched = $content.add($childs);
|
|
|
|
if($parentAccordion.hasClass('open')) {
|
|
$matched.each(function() {
|
|
var currentHeight = $(this).data('oHeight');
|
|
|
|
switch (operation) {
|
|
case '+':
|
|
$(this).data('oHeight', currentHeight + qty);
|
|
break;
|
|
case '-':
|
|
$(this).data('oHeight', currentHeight - qty);
|
|
break;
|
|
default:
|
|
throw 'updateParentHeight method needs an operation';
|
|
}
|
|
|
|
$(this).css('max-height', $(this).data('oHeight'));
|
|
});
|
|
}
|
|
}
|
|
|
|
function refreshHeight($accordion) {
|
|
if($accordion.hasClass('open')) {
|
|
var $content = $accordion.find('> [data-content]'),
|
|
$childs = $content.find('[data-accordion].open > [data-content]'),
|
|
$matched = $content.add($childs);
|
|
|
|
calculateHeight($matched);
|
|
|
|
$matched.css('max-height', $matched.data('oHeight'));
|
|
}
|
|
}
|
|
|
|
function closeAccordion($accordion, $content) {
|
|
$accordion.trigger('accordion.close');
|
|
|
|
if(CSStransitions) {
|
|
if(accordionHasParent) {
|
|
var $parentAccordions = $accordion.parents('[data-accordion]');
|
|
|
|
updateParentHeight($parentAccordions, $accordion, $content.data('oHeight'), '-');
|
|
}
|
|
|
|
$content.css(closedCSS);
|
|
|
|
$accordion.removeClass('open');
|
|
} else {
|
|
$content.css('max-height', $content.data('oHeight'));
|
|
|
|
$content.animate(closedCSS, opts.transitionSpeed);
|
|
|
|
$accordion.removeClass('open');
|
|
}
|
|
}
|
|
|
|
function openAccordion($accordion, $content) {
|
|
$accordion.trigger('accordion.open');
|
|
if(CSStransitions) {
|
|
toggleTransition($content);
|
|
|
|
if(accordionHasParent) {
|
|
var $parentAccordions = $accordion.parents('[data-accordion]');
|
|
|
|
updateParentHeight($parentAccordions, $accordion, $content.data('oHeight'), '+');
|
|
}
|
|
|
|
requestAnimFrame(function() {
|
|
$content.css('max-height', $content.data('oHeight'));
|
|
});
|
|
|
|
$accordion.addClass('open');
|
|
} else {
|
|
$content.animate({
|
|
'max-height': $content.data('oHeight')
|
|
}, opts.transitionSpeed, function() {
|
|
$content.css({'max-height': 'none'});
|
|
});
|
|
|
|
$accordion.addClass('open');
|
|
}
|
|
}
|
|
|
|
function closeSiblingAccordions($accordion) {
|
|
var $accordionGroup = $accordion.closest(opts.groupElement);
|
|
|
|
var $siblings = $accordion.siblings('[data-accordion]').filter('.open'),
|
|
$siblingsChildren = $siblings.find('[data-accordion]').filter('.open');
|
|
|
|
var $otherAccordions = $siblings.add($siblingsChildren);
|
|
|
|
$otherAccordions.each(function() {
|
|
var $accordion = $(this),
|
|
$content = $accordion.find(opts.contentElement);
|
|
|
|
closeAccordion($accordion, $content);
|
|
});
|
|
|
|
$otherAccordions.removeClass('open');
|
|
}
|
|
|
|
function toggleAccordion() {
|
|
var isAccordionGroup = (opts.singleOpen) ? $accordion.parents(opts.groupElement).length > 0 : false;
|
|
|
|
calculateHeight($content);
|
|
|
|
if(isAccordionGroup) {
|
|
closeSiblingAccordions($accordion);
|
|
}
|
|
|
|
if($accordion.hasClass('open')) {
|
|
closeAccordion($accordion, $content);
|
|
} else {
|
|
openAccordion($accordion, $content);
|
|
}
|
|
}
|
|
|
|
function addEventListeners() {
|
|
$controls.on('click', toggleAccordion);
|
|
|
|
$controls.on('accordion.toggle', function() {
|
|
if(opts.singleOpen && $controls.length > 1) {
|
|
return false;
|
|
}
|
|
|
|
toggleAccordion();
|
|
});
|
|
|
|
$(window).on('resize', debounce(function() {
|
|
refreshHeight($accordion);
|
|
}));
|
|
}
|
|
|
|
function setup() {
|
|
$content.each(function() {
|
|
var $curr = $(this);
|
|
|
|
if($curr.css('max-height') != 0) {
|
|
if(!$curr.closest('[data-accordion]').hasClass('open')) {
|
|
$curr.css({ 'max-height': 0, 'overflow': 'hidden' });
|
|
} else {
|
|
toggleTransition($curr);
|
|
calculateHeight($curr);
|
|
|
|
$curr.css('max-height', $curr.data('oHeight'));
|
|
}
|
|
}
|
|
});
|
|
|
|
|
|
if(!$accordion.attr('data-accordion')) {
|
|
$accordion.attr('data-accordion', '');
|
|
$accordion.find(opts.controlElement).attr('data-control', '');
|
|
$accordion.find(opts.contentElement).attr('data-content', '');
|
|
}
|
|
}
|
|
|
|
setup();
|
|
addEventListeners();
|
|
};
|
|
|
|
$.fn[pluginName] = function ( options ) {
|
|
return this.each(function () {
|
|
if (!$.data(this, 'plugin_' + pluginName)) {
|
|
$.data(this, 'plugin_' + pluginName,
|
|
new Accordion( this, options ));
|
|
}
|
|
});
|
|
}
|
|
|
|
})( jQuery, window, document );
|
|
|
|
$(document).ready(function() {
|
|
$('#multiple [data-accordion]').accordion({
|
|
singleOpen: false
|
|
});
|
|
});
|
|
|
|
</script>
|
|
|
|
|
|
<script src="/dist/assets/js/bootstrap-3.0.3.min.js"></script>
|
|
<script src="/dist/assets/js/archive.js"></script>
|
|
<script type="text/javascript">
|
|
!function(){var analytics=window.analytics=window.analytics||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error("Segment snippet included twice.");else{analytics.invoked=!0;analytics.methods=["trackSubmit","trackClick","trackLink","trackForm","pageview","identify","reset","group","track","ready","alias","debug","page","once","off","on"];analytics.factory=function(t){return function(){var e=Array.prototype.slice.call(arguments);e.unshift(t);analytics.push(e);return analytics}};for(var t=0;t<analytics.methods.length;t++){var e=analytics.methods[t];analytics[e]=analytics.factory(e)}analytics.load=function(t){var e=document.createElement("script");e.type="text/javascript";e.async=!0;e.src=("https:"===document.location.protocol?"https://":"http://")+"cdn.segment.com/analytics.js/v1/"+t+"/analytics.min.js";var n=document.getElementsByTagName("script")[0];n.parentNode.insertBefore(e,n)};analytics.SNIPPET_VERSION="4.0.0";
|
|
analytics.load("IWj9D0UpZHZdZUZX9jl98PcpBFWBnBMy");
|
|
analytics.page();
|
|
}}();
|
|
</script>
|
|
|