The Container Security Checklist
- 1. KubeSec Enterprise Online A Webinar Series
- 2. 2 Housekeeping To ask a question, click on Question button to the right hand chat menu Questions A copy of the slides will be made available to all attendees Slides Feedback on webinar series, topics you’d like to see, welcome at [email protected] Feedback
- 3. © 2020 Aqua Security Software Ltd., All Rights Reserved Liz Rice VP Open Source Engineering, Aqua Security @lizrice | @aquasecteam The Container Security Checklist
- 4. @lizrice
- 5. @lizrice Appendix: Security Checklist This appendix covers some important items you should at least think about when considering how best to secure your container deployments. In your environment it might well not make sense to apply every item, but if you have thought about them, you will be off to a good start. No doubt this list is not absolutely comprehensive!
- 6. @lizrice Build Deploy Run Host machines Container images Build machines Container config Secrets Runtime & network security
- 7. @lizrice Build Deploy Run Host machines Container images Build machines Container config Secrets Runtime & network security Are your builds running separately from your production cluster?
- 8. @lizrice Don’t run builds in your production cluster Dockerfile … RUN blah blah … Kernel Build processes Applications Docker daemon /var/run/docker.sock
- 9. @lizrice Don’t run builds in your production cluster* Dockerfile … RUN blah blah … Kernel Sandbox Build processes Applications Docker daemon /var/run/docker.sock * Unless you are very sure you know what you’re doing
- 10. @lizrice Build Deploy Run Host machines Container images Build machines Container config Secrets Runtime & network security Is all executable code added to a container image at build time?
- 11. @lizrice Treat containers as immutable app Scan for vulnerable packages & dependencies app More code curl / apt / yum
- 12. @lizrice Build Deploy Run Host machines Container images Build machines Container config Secrets Runtime & network security Are you avoiding –privileged?
- 13. @lizrice --privileged “The most dangerous flag in computing” -- Andrew Martin
- 14. @lizrice More granular permissions than root Most containers don’t need to l Install Kernel modules (CAP_SYS_MODULE) l Change the system time (CAP_SYS_TIME) l Trace / modify arbitrary processes (CAP_SYS_PTRACE) Linux capabilities
- 15. @lizrice $ docker run --rm -it --cap-add=ALL ubuntu /# more /proc/1/status | grep CapEff CapEff: 0000003fffffffff $ docker run --rm -it --cap-drop=ALL ubuntu /# more /proc/1/status | grep CapEff CapEff: 0000000000000000 $ docker run --rm -it ubuntu /# more /proc/1/status | grep CapEff CapEff: 00000000a80425fb $ docker run --rm -it --privileged ubuntu /# more /proc/1/status | grep CapEff CapEff: 0000003fffffffff All capabilities
- 16. @lizrice $ docker run --rm -it ubuntu root@316a2ab0ddcb:/# ls /dev console core fd full mqueue null ptmx pts random shm stderr stdin stdout tty urandom zero $ docker run --rm -it --privileged ubuntu root@87c19bbc393a:/# ls /dev autofs loop-control ptmx tty14 tty33 tty52 ttyS13 ttyS4 vcsa bsg loop0 pts tty15 tty34 tty53 ttyS14 ttyS5 vcsa1 btrfs-control loop1 random tty16 tty35 tty54 ttyS15 ttyS6 vcsa2 console loop2 rfkill tty17 tty36 tty55 ttyS16 ttyS7 vcsa3 core loop3 rtc0 tty18 tty37 tty56 ttyS17 ttyS8 vcsa4 cpu_dma_latency loop4 sda tty19 tty38 tty57 ttyS18 ttyS9 vcsa5 cuse loop5 sda1 tty2 tty39 tty58 ttyS19 ttyprintk vcsa6 dm-0 loop6 sg0 tty20 tty4 tty59 ttyS2 udmabuf vcsu dm-1 loop7 shm tty21 tty40 tty6 ttyS20 uhid vcsu1 dri mapper snapshot tty22 tty41 tty60 ttyS21 uinput vcsu2 ecryptfs mcelog snd tty23 tty42 tty61 ttyS22 urandom vcsu3 fb0 mem stderr tty24 tty43 tty62 ttyS23 userio vcsu4 fd memory_bandwidth stdin tty25 tty44 tty63 ttyS24 vboxguest vcsu5 … All host devices
- 17. @lizrice Build Deploy Run Host machines Container images Build machines Container config Secrets Runtime & network security Are you keeping hosts up to date with the latest security releases?
- 18. @lizrice
- 19. @lizrice
- 20. @lizrice Build Deploy Run Host machines Container images Build machines Container config Secrets Runtime & network security Are your secrets encrypted at rest and in transit?
- 21. @lizrice $ kubectl get secret my-secret -o jsonpath="{.data.password}" | base64 --decode Keepthissecret $ sudo grep keepthissecret /var/lib/etcd/member/snap/db Binary file /var/lib/etcd/member/snap/db matches
- 22. @lizrice
- 23. @lizrice l Encrypt etcd l Or use a secrets manager like Vault, KMS, etc … Encrypting secrets
- 24. @lizrice Build Deploy Run Host machines Container images Build machines Container config Secrets Runtime & network security Can you prevent container drift?
- 25. @lizrice
- 26. @lizrice Are your builds running separately from your production cluster? Is all executable code added to a container image at build time? Are you avoiding –privileged? Are you keeping hosts up to date with the latest security releases? Are your secrets encrypted at rest and in transit? Can you prevent container drift?
- 28. 28 BeerSecOps Podcast Series – Presented by Steve Giguere https://www.aquasec.com/resources/type/podcasts/
- 29. 29 Sign up at https://kubesec.aquasec.com/enterprise_online_series “Achieving security and compliance in a large, multi-cluster Kubernetes fleet” “Securing your Kubernetes Ingress through Gateway Deployment Patterns” “How Security Evolves with your Kubernetes Footprint” New Sessions Added!
- 30. 30 https://kubesec.aquasec.com/enterprise_online_series Coming up next
- 31. Thank you