![Docker Basics
• There are different images, which are stored in the registry, from where it pull
the image, to create different containers.
• Generally, a Dockerfile (contains commands/instructions) is used to build a
container.
• If you want to run a multi-container Docker application – Docker Compose is
your go to tool.
• Common docker/docker compose commands, that are generally used -
• docker pull <image-name> - used to pull images from registry
• docker run [args] <image-name> - used to run a container from the image defined
• docker build [args] – used to build a container out of a Dockerfile
• docker-compose up – used to build a multi-container setup from docker-compose.yml
• docker ps – used to list down the active containers
• For every RUN, COPY, ADD instruction in a Dockerfile, a layer is created.](https://image.slidesharecdn.com/securingcontainersfromdayone-211121061633/85/Securing-Containers-From-Day-One-null-Ahmedabad-Meetup-15-320.jpg)
![Some Resources
• Containers from Scratch [YouTube]
• Dockerfile Best Practices
• Multi-stage builds
• dockle checkpoint comparison
• Tips for optimizing builds
• Dockerfile Tutorial
• Practical guide to write Dockerfile](https://image.slidesharecdn.com/securingcontainersfromdayone-211121061633/85/Securing-Containers-From-Day-One-null-Ahmedabad-Meetup-23-320.jpg)
Ad
More Related Content
What's hot (20)
Similar to Securing Containers From Day One | null Ahmedabad Meetup (20)
Ad
Recently uploaded (20)
Ad
Securing Containers From Day One | null Ahmedabad Meetup
- 1. Securing Containers from Day One Kumar Ashwin 0xcardinal.com null Ahmedabad Container Security
- 2. About Me Kumar Ashwin • Security Consultant @ Payatu • Manages null Study Groups for six different Security Domains and also contributes to other communities • 0xcardinal.com • 0xCardinal on social platforms
- 3. Agenda • What are containers? • Why we need containers? • VM v/s Containers • Cgroups & Namespaces • Docker Primer • Build Optimization • Security • Resources • QnA https://giphy.com/gifs/rockstargames-usz0fqhUiVxSs6IUKB
- 4. What are containers? Containers are nothing but just another Linux process which is isolated from other processes running on the same host.
- 6. Virtual Machines v/s Containers https://www.docker.com/blog/containers-replacing-virtual-machines/
- 8. namespaces It defines what a container can see, uses syscalls to do so. https://wizardzines.com/comics/namespaces/
- 9. Demo : namespaces Will share how the name spaces work using unshare and creating namespaces for user and network, and demonstrating the difference.
- 10. cgroups It defines what a container can use or access, uses syscalls to do so. https://wizardzines.com/comics/cgroups/
- 11. Docker Primer 🐳
- 12. Docker itself is not a Container. Myth busting
- 13. What is Docker? • Docker is a container engine, which is a piece of software that accepts user requests, including command line options, pulls images, and from the end user's perspective runs the container. • Other than docker there are other container engines as well, like - RKT, CRI-O, and LXD
- 15. Docker Basics • There are different images, which are stored in the registry, from where it pull the image, to create different containers. • Generally, a Dockerfile (contains commands/instructions) is used to build a container. • If you want to run a multi-container Docker application – Docker Compose is your go to tool. • Common docker/docker compose commands, that are generally used - • docker pull <image-name> - used to pull images from registry • docker run [args] <image-name> - used to run a container from the image defined • docker build [args] – used to build a container out of a Dockerfile • docker-compose up – used to build a multi-container setup from docker-compose.yml • docker ps – used to list down the active containers • For every RUN, COPY, ADD instruction in a Dockerfile, a layer is created.
- 17. Build Optimization • Minimize number of layers. Improves performance. • Multi-Stage Builds • Do not install unnecessary packages • Decouple the application • Slim down the image – using docker-slim • It promises to slim down the image by 30x - https://github.com/docker-slim/docker-slim
- 18. Why Dockerfile Security? • Here we will be talking about securing the images pre-build and what are the practices that we can follow. • A great start point to look for security issues are Dockerfile. • Dockerfiles? • These are the blueprints of the system/container that is to be created. • Infrastructure as a Code (IaaC) • One of the main components for the entire supply chain security.
- 19. Security Best-Practices • Prefer minimal base images • Use .dockerignore file to exclude files from build • Create Golden Images • Golden Images are hardened base images than can be used further development • Do not run containers as root • Adding this in the Dockerfile will help in chainging the user FROM alpine:latest RUN useradd –u 1234 non-root-user USER non-root-user • Do not commit secrets in Dockerfile or Containers • Can use BuildKit to pass secrets to use in containers securely • Use COPY instead of ADD, wherever possible
- 20. More Security Stuff • Use linters like hadolint, that will help to build best practice Docker Images.
- 21. More Security Stuff • Use dockle to scan images against CIS benchmarks. • CIS Benchmark security Comparision
- 22. Seccomp • It is a security feature in the Linux kernel. It can be used to restrict any system calls in the docker container. • E.g.,
- 23. Some Resources • Containers from Scratch [YouTube] • Dockerfile Best Practices • Multi-stage builds • dockle checkpoint comparison • Tips for optimizing builds • Dockerfile Tutorial • Practical guide to write Dockerfile
- 24. QnA Securing Containers from Day One Thank You! twitter.com/0xcardinal Kumar Ashwin