Skip to content

12-container-security

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

12-container-security

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
01-threat-modeling
01-threat-modeling
 
 
02-attacks
02-attacks
 
 
03-mitigation
03-mitigation
 
 
04-testing
04-testing
 
 
README.md
README.md
 
 

README.md

Chapter 12: Container Security

Advanced container security including threat modeling, common attacks, mitigation strategies, and security testing.

Learning objectives

  • Understand container attack surfaces and threat modeling
  • Identify common container attacks and vulnerabilities
  • Implement comprehensive security mitigation strategies
  • Conduct security testing and incident response

Overview

Container security is critical in modern infrastructure, as containers introduce unique attack surfaces and vulnerabilities. This chapter explores common container attacks, security threats, and comprehensive mitigation strategies. Understanding these security concepts is essential for building secure containerized applications in your custom Linux distribution.

Components

  • Container threat modeling and attack surface analysis
  • Common container attacks and exploits
  • Vulnerability classes (CVEs, misconfigurations)
  • Comprehensive mitigation strategies
  • Advanced security techniques (gVisor, Kata, SELinux/AppArmor)
  • Incident response and forensics
  • Security testing and validation

Quick start (Security hardening)

# Run container with security hardening
podman run --rm \
  --security-opt seccomp=/path/to/seccomp-profile.json \
  --security-opt apparmor=podman-default \
  --cap-drop=ALL --cap-add=NET_BIND_SERVICE \
  --read-only --tmpfs /tmp \
  --user 1000:1000 \
  -p 8080:8080 myapp:latest

# Scan image for vulnerabilities
trivy image myapp:latest

# Verify image signature
cosign verify myregistry.com/myapp:latest

Security Threat Model

graph TD
	A[External Attackers] --> B[Container Attack Surface]
	C[Malicious Insiders] --> B
	D[Supply Chain] --> B
	B --> E[Host Kernel]
	B --> F[Container Runtime]
	B --> G[Images]
	B --> H[Network]
	B --> I[Storage]
	E --> J[Container Escape]
	F --> K[Runtime Exploit]
	G --> L[Image Tampering]
	H --> M[Network Attack]
	I --> N[Data Breach]
Loading

Detailed Topics

01. Threat Modeling

02. Common Attacks

03. Mitigation Strategies

04. Security Testing

Security Best Practices

Defense in Depth

  1. Image Security: Use minimal base images, scan for vulnerabilities, sign images
  2. Runtime Security: Apply security contexts, use seccomp/AppArmor, drop capabilities
  3. Network Security: Implement network policies, segment traffic, use TLS
  4. Access Control: Enforce RBAC, use secrets management, audit access
  5. Monitoring: Enable logging, monitor anomalies, set up alerts

Example Hardened Deployment

# Build secure image
docker build --no-cache -t myapp:secure .

# Scan for vulnerabilities
trivy image myapp:secure

# Sign image
cosign sign myregistry.com/myapp:secure

# Deploy with security controls
podman run -d \
  --name secure-app \
  --security-opt seccomp=default.json \
  --security-opt apparmor=docker-default \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --read-only \
  --tmpfs /tmp \
  --tmpfs /run \
  --user 1000:1000 \
  --memory 512m \
  --cpus 1.0 \
  --pids-limit 100 \
  --network mynetwork \
  -p 8080:8080 \
  myapp:secure

Incident Response

Response Workflow

sequenceDiagram
	participant D as Detection
	participant I as Isolation
	participant A as Analysis
	participant R as Recovery
	participant L as Lessons

	D->>I: Alert triggered
	I->>I: Pause/stop container
	I->>A: Capture logs & filesystem
	A->>A: Forensic analysis
	A->>R: Identify root cause
	R->>R: Deploy clean version
	R->>L: Update policies
	L->>L: Document incident
Loading

Exercises

  • Exercise 1: Scan a container image and remediate critical vulnerabilities.
  • Exercise 2: Implement a seccomp profile that blocks dangerous syscalls and test it.
  • Exercise 3: Configure AppArmor/SELinux policies for a containerized application.
  • Exercise 4: Simulate a privilege escalation attack and verify mitigation controls.
  • Exercise 5: Create an incident response playbook for container compromise.
  • Exercise 6: Generate and analyze an SBOM for your container images.

Next steps

  • Apply security practices to your complete LFS distribution
  • Implement continuous security scanning in your CI/CD pipeline
  • Develop custom security policies for your use cases
  • Review the detailed content in 01-threat-modeling/01-container-security.md for comprehensive examples and attack scenarios
  • Proceed to Chapter 13 to compare our custom LFS distribution with modern cloud-native operating systems

References