Table Of Content

Securing Docker Learn how to secure your Docker environment and keep your environments secure irrespective of the threats out there Scott Gallagher BIRMINGHAM - MUMBAI Securing Docker Copyright © 2016 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. First published: March 2016 Production reference: 1230316 Published by Packt Publishing Ltd. Livery Place 35 Livery Street Birmingham B3 2PB, UK. ISBN 978-1-78588-885-4 www.packtpub.com [ FM-2 ] Credits Author Project Coordinator Scott Gallagher Shweta H Birwatkar Reviewer Proofreader Harald Albers Safis Editing Commissioning Editor Indexer Priya Singh Monica Ajmera Mehta Acquisition Editor Graphics Prachi Bisht Disha Haria Content Development Editor Production Coordinator Arshiya Ayaz Umer Nilesh Mohite Technical Editor Cover Work Suwarna Patil Nilesh Mohite Copy Editor Vibha Shukla [ FM-3 ] About the Author Scott Gallagher has been fascinated with technology since he was in elementary school, when he used to play Oregon Trail. His love continued through middle school, working on more Apple IIe computers. In high school, he learned how build computers and program in BASIC! His college years were all about server technologies such as Novell, Microsoft, and Red Hat. After college, he continued to work on Novell, all while keeping an interest in all the technologies. He then moved into managing Microsoft environments and eventually into what he is the most passionate about, Linux environments, and now his focus is on Docker and cloud environments. I would like to thank my family for the support they have given me, not only throughout the work on this book, but throughout my life and career. I would like to thank my wife, who is my soulmate, the love of my life, and the most important person in my life and the reason I push myself to be the best I can be each day. I would also like to thank my kids, who are the most amazing kids in this world, for being able to watch them grow each day; I truly am blessed. Finally, I would like to thank my parents, who have helped me become the person I am today. [ FM-4 ] About the Reviewer Harald Albers works as a Java developer and security engineer in Hamburg, Germany. In addition to developing distributed web applications, he also sets up and maintains the build infrastructure, staging, and production environments for these applications. Most of his work is only possible because of Docker's simple and elegant solutions for the challenges of provisioning, deployment, and orchestration. He started using Docker and contributing to the Docker project in mid-2014. He is a member of the Docker Governance Advisory Board, 2015-2016. [ FM-5 ] www.PacktPub.com eBooks, discount offers, and more Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub. com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at [email protected] for more details. At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks. TM https://www2.packtpub.com/books/subscription/packtlib Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books. Why subscribe? • Fully searchable across every book published by Packt • Copy and paste, print, and bookmark content • On demand and accessible via a web browser [ FM-6 ] Table of Contents Preface v Chapter 1: Securing Docker Hosts 1 Docker host overview 1 Discussing Docker host 2 Virtualization and isolation 2 Attack surface of Docker daemon 4 Protecting the Docker daemon 5 Securing Docker hosts 8 Docker Machine 8 SELinux and AppArmor 11 Auto-patching hosts 11 Summary 12 Chapter 2: Securing Docker Components 13 Docker Content Trust 13 Docker Content Trust components 14 Signing images 16 Hardware signing 18 Docker Subscription 18 Docker Trusted Registry 20 Installation 20 Securing Docker Trusted Registry 22 Administering 28 Workflow 28 Docker Registry 30 Installation 30 Configuration and security 32 Summary 35 [ i ] Table of Contents Chapter 3: Securing and Hardening Linux Kernels 37 Linux kernel hardening guides 37 SANS hardening guide deep dive 38 Access controls 40 Distribution focused 42 Linux kernel hardening tools 42 Grsecurity 43 Lynis 44 Summary 45 Chapter 4: Docker Bench for Security 47 Docker security – best practices 48 Docker – best practices 48 CIS guide 48 Host configuration 49 Docker daemon configuration 49 Docker daemon configuration files 49 Container images/runtime 49 Docker security operations 50 The Docker Bench Security application 50 Running the tool 50 Running the tool – host configuration 51 Running the tool – Docker daemon configuration 52 Running the tool – Docker daemon configuration files 53 Running the tool – container images and build files 55 Running the tool – container runtime 55 Running the tool – Docker security operations 55 Understanding the output 56 Understanding the output – host configuration 56 Understanding the output – the Docker daemon configuration 57 Understanding the output – the Docker daemon configuration files 57 Understanding the output – container images and build files 57 Understanding the output – container runtime 58 Understanding the output – Docker security operations 60 Summary 60 Chapter 5: Monitoring and Reporting Docker Security Incidents 61 Docker security monitoring 62 Docker CVE 62 Mailing lists 62 Docker security reporting 63 Responsible disclosure 63 Security reporting 64 [ ii ] Table of Contents Additional Docker security resources 64 Docker Notary 64 Hardware signing 65 Reading materials 66 Awesome Docker 67 Summary 67 Chapter 6: Using Docker's Built-in Security Features 69 Docker tools 70 Using TLS 70 Read-only containers 74 Docker security fundamentals 76 Kernel namespaces 76 Control groups 76 Linux kernel capabilities 79 Containers versus virtual machines 80 Summary 80 Chapter 7: Securing Docker with Third-party Tools 81 Third-party tools 82 Traffic Authorization 82 Summon 83 sVirt and SELinux 84 Other third-party tools 86 dockersh 86 DockerUI 86 Shipyard 88 Logspout 90 Summary 91 Chapter 8: Keeping up Security 93 Keeping up with security 94 E-mail list options 94 The two e-mail lists are as follows: 94 GitHub issues 95 IRC rooms 102 CVE websites 103 Other areas of interest 104 Summary 105 Index 107 [ iii ]